CVE-2015-1158

high
New! CVE Severity Now Using CVSS v3

The calculated severity for CVEs has been updated to use CVSS v3 by default. CVEs that do not have a CVSS v3 score will fall back CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.

Description

The add_job function in scheduler/ipp.c in cupsd in CUPS before 2.0.3 performs incorrect free operations for multiple-value job-originating-host-name attributes, which allows remote attackers to trigger data corruption for reference-counted strings via a crafted (1) IPP_CREATE_JOB or (2) IPP_PRINT_JOB request, as demonstrated by replacing the configuration file and consequently executing arbitrary code.

References

http://googleprojectzero.blogspot.in/2015/06/owning-internet-printing-case-study-in.html

http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10702

http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00003.html

http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00006.html

http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00010.html

http://rhn.redhat.com/errata/RHSA-2015-1123.html

http://www.cups.org/blog.php?L1082

http://www.debian.org/security/2015/dsa-3283

http://www.kb.cert.org/vuls/id/810572

http://www.securityfocus.com/bid/75098

http://www.securitytracker.com/id/1032556

http://www.ubuntu.com/usn/USN-2629-1

https://bugzilla.opensuse.org/show_bug.cgi?id=924208

https://bugzilla.redhat.com/show_bug.cgi?id=1221641

https://code.google.com/p/google-security-research/issues/detail?id=455

https://github.com/0x00string/oldays/blob/master/CVE-2015-1158.py

https://security.gentoo.org/glsa/201510-07

https://www.cups.org/str.php?L4609

https://www.exploit-db.com/exploits/37336/

https://www.exploit-db.com/exploits/41233/

Details

Source: MITRE

Published: 2015-06-26

Updated: 2017-09-23

Type: CWE-254

Risk Information

CVSS v2

Base Score: 10

Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C

Impact Score: 10

Exploitability Score: 10

Severity: HIGH

Vulnerable Software

Configuration 1

OR

cpe:2.3:a:cups:cups:*:*:*:*:*:*:*:* versions up to 2.0.2 (inclusive)

Tenable Plugins

View all (20 total)

IDNameProductFamilySeverity
124935EulerOS Virtualization 3.0.1.0 : cups (EulerOS-SA-2019-1432)NessusHuawei Local Security Checks
high
119966SUSE SLES12 Security Update : cups154 (SUSE-SU-2015:1044-2)NessusSuSE Local Security Checks
critical
119965SUSE SLES12 Security Update : cups154 (SUSE-SU-2015:1044-1)NessusSuSE Local Security Checks
critical
86692GLSA-201510-07 : CUPS: Multiple vulnerabilitiesNessusGentoo Local Security Checks
critical
84595Amazon Linux AMI : cups (ALAS-2015-559)NessusAmazon Linux Local Security Checks
critical
84588Slackware 13.0 / 13.1 / 13.37 / 14.0 / 14.1 / current : cups (SSA:2015-188-01)NessusSlackware Local Security Checks
critical
84311Fedora 21 : cups-1.7.5-17.fc21 (2015-9801)NessusFedora Local Security Checks
critical
84310Fedora 22 : cups-2.0.3-1.fc22 (2015-9726)NessusFedora Local Security Checks
critical
84276CentOS 6 / 7 : cups (CESA-2015:1123)NessusCentOS Local Security Checks
critical
84259Scientific Linux Security Update : cups on SL6.x, SL7.x i386/x86_64 (20150617)NessusScientific Linux Local Security Checks
critical
84258RHEL 6 / 7 : cups (RHSA-2015:1123)NessusRed Hat Local Security Checks
critical
84257OracleVM 3.3 : cups (OVMSA-2015-0071)NessusOracleVM Local Security Checks
critical
84256Oracle Linux 6 / 7 : cups (ELSA-2015-1123)NessusOracle Linux Local Security Checks
critical
84184openSUSE Security Update : cups (openSUSE-2015-418)NessusSuSE Local Security Checks
critical
84149CUPS < 2.0.3 Multiple VulnerabilitiesNessusMisc.
critical
84145SUSE SLED12 / SLES12 Security Update : cups (SUSE-SU-2015:1041-1)NessusSuSE Local Security Checks
critical
84117Ubuntu 12.04 LTS / 14.04 LTS / 14.10 / 15.04 : cups vulnerabilities (USN-2629-1)NessusUbuntu Local Security Checks
critical
84070FreeBSD : cups -- multiple vulnerabilities (a40ec970-0efa-11e5-90e4-d050996490d0)NessusFreeBSD Local Security Checks
critical
84063Debian DSA-3283-1 : cups - security updateNessusDebian Local Security Checks
critical
84061Debian DLA-239-1 : cups security updateNessusDebian Local Security Checks
critical