A Incorrect Default Permissions vulnerability in the packaging of cups of SUSE Linux Enterprise Server 11-SP4-LTSS, SUSE Manager Server 4.0, SUSE OpenStack Cloud Crowbar 9; openSUSE Leap 15.2, Factory allows local attackers with control of the lp users to create files as root with 0644 permissions without the ability to set the content. This issue affects: SUSE Linux Enterprise Server 11-SP4-LTSS cups versions prior to 1.3.9. SUSE Manager Server 4.0 cups versions prior to 2.2.7. SUSE OpenStack Cloud Crowbar 9 cups versions prior to 1.7.5. openSUSE Leap 15.2 cups versions prior to 2.2.7. openSUSE Factory cups version 2.3.3op2-2.1 and prior versions.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - cups: stack-buffer-overflow in libcups's asn1_get_packed function (CVE-2019-8696)

  - A localhost.localdomain whitelist entry in valid_host() in scheduler/client.c in CUPS before 2.2.2 allows     remote attackers to execute arbitrary IPP commands by sending POST requests to the CUPS daemon in     conjunction with DNS rebinding. The localhost.localdomain name is often resolved via a DNS server (neither     the OS nor the web browser is responsible for ensuring that localhost.localdomain is 127.0.0.1).
    (CVE-2017-18190)

  - In macOS High Sierra before 10.13.5, an issue existed in CUPS. This issue was addressed with improved     access restrictions. (CVE-2018-4180, CVE-2018-4181)

  - The session cookie generated by the CUPS web interface was easy to guess on Linux, allowing unauthorized     scripted access to the web interface when the web interface is enabled. This issue affected versions prior     to v2.2.10. (CVE-2018-4300)

  - Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2018-4300. Reason: This candidate is a     duplicate of CVE-2018-4300. Notes: All CVE users should reference CVE-2018-4300 instead of this candidate.
    All references and descriptions in this candidate have been removed to prevent accidental usage     (CVE-2018-4700)

  - A buffer overflow issue was addressed with improved memory handling. This issue is fixed in macOS Mojave     10.14.6, Security Update 2019-004 High Sierra, Security Update 2019-004 Sierra. An attacker in a     privileged network position may be able to execute arbitrary code. (CVE-2019-8675)

  - An input validation issue was addressed with improved memory handling. This issue is fixed in macOS Big     Sur 11.1, Security Update 2020-001 Catalina, Security Update 2020-007 Mojave. A malicious application may     be able to read restricted memory. (CVE-2020-10001)

  - A memory corruption issue was addressed with improved validation. This issue is fixed in macOS Catalina     10.15.4. An application may be able to gain elevated privileges. (CVE-2020-3898)

  - A Incorrect Default Permissions vulnerability in the packaging of cups of SUSE Linux Enterprise Server     11-SP4-LTSS, SUSE Manager Server 4.0, SUSE OpenStack Cloud Crowbar 9; openSUSE Leap 15.2, Factory allows     local attackers with control of the lp users to create files as root with 0644 permissions without the     ability to set the content. This issue affects: SUSE Linux Enterprise Server 11-SP4-LTSS cups versions     prior to 1.3.9. SUSE Manager Server 4.0 cups versions prior to 2.2.7. SUSE OpenStack Cloud Crowbar 9 cups     versions prior to 1.7.5. openSUSE Leap 15.2 cups versions prior to 2.2.7. openSUSE Factory cups version     2.3.3op2-2.1 and prior versions. (CVE-2021-25317)

  - OpenPrinting CUPS is an open source printing system. In versions 2.4.2 and prior, a heap buffer overflow     vulnerability would allow a remote attacker to launch a denial of service (DoS) attack. A buffer overflow     vulnerability in the function `format_log_line` could allow remote attackers to cause a DoS on the     affected system. Exploitation of the vulnerability can be triggered when the configuration file     `cupsd.conf` sets the value of `loglevel `to `DEBUG`. No known patches or workarounds exist at time of     publication. (CVE-2023-32324)

  - An authentication issue was addressed with improved state management. This issue is fixed in macOS Big Sur     11.7.7, macOS Monterey 12.6.6, macOS Ventura 13.4. An unauthenticated user may be able to access recently     printed documents. (CVE-2023-32360)

  - OpenPrinting CUPS is a standards-based, open source printing system for Linux and other Unix-like     operating systems. Starting in version 2.0.0 and prior to version 2.4.6, CUPS logs data of free memory to     the logging service AFTER the connection has been closed, when it should have logged the data right     before. This is a use-after-free bug that impacts the entire cupsd process. The exact cause of this issue     is the function `httpClose(con->http)` being called in `scheduler/client.c`. The problem is that httpClose     always, provided its argument is not null, frees the pointer at the end of the call, only for     cupsdLogClient to pass the pointer to httpGetHostname. This issue happens in function `cupsdAcceptClient`     if LogLevel is warn or higher and in two scenarios: there is a double-lookup for the IP Address     (HostNameLookups Double is set in `cupsd.conf`) which fails to resolve, or if CUPS is compiled with TCP     wrappers and the connection is refused by rules from `/etc/hosts.allow` and `/etc/hosts.deny`. Version     2.4.6 has a patch for this issue. (CVE-2023-34241)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

According to the versions of the cups packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - A Incorrect Default Permissions vulnerability in the packaging of cups of SUSE Linux Enterprise Server     11-SP4-LTSS, SUSE Manager Server 4.0, SUSE OpenStack Cloud Crowbar 9; openSUSE Leap 15.2, Factory allows     local attackers with control of the lp users to create files as root with 0644 permissions without the     ability to set the content. This issue affects: SUSE Linux Enterprise Server 11-SP4-LTSS cups versions     prior to 1.3.9. SUSE Manager Server 4.0 cups versions prior to 2.2.7. SUSE OpenStack Cloud Crowbar 9 cups     versions prior to 1.7.5. openSUSE Leap 15.2 cups versions prior to 2.2.7. openSUSE Factory cups version     2.3.3op2-2.1 and prior versions. (CVE-2021-25317)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the cups packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - An input validation issue was addressed with improved memory handling. This issue is fixed in macOS Big     Sur 11.1, Security Update 2020-001 Catalina, Security Update 2020-007 Mojave. A malicious application may     be able to read restricted memory. (CVE-2020-10001)

  - A Incorrect Default Permissions vulnerability in the packaging of cups of SUSE Linux Enterprise Server     11-SP4-LTSS, SUSE Manager Server 4.0, SUSE OpenStack Cloud Crowbar 9; openSUSE Leap 15.2, Factory allows     local attackers with control of the lp users to create files as root with 0644 permissions without the     ability to set the content. This issue affects: SUSE Linux Enterprise Server 11-SP4-LTSS cups versions     prior to 1.3.9. SUSE Manager Server 4.0 cups versions prior to 2.2.7. SUSE OpenStack Cloud Crowbar 9 cups     versions prior to 1.7.5. openSUSE Leap 15.2 cups versions prior to 2.2.7. openSUSE Factory cups version     2.3.3op2-2.1 and prior versions. (CVE-2021-25317)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the cups package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - An input validation issue was addressed with improved memory handling. This issue is fixed in macOS Big     Sur 11.1, Security Update 2020-001 Catalina, Security Update 2020-007 Mojave. A malicious application may     be able to read restricted memory. (CVE-2020-10001)

  - A Incorrect Default Permissions vulnerability in the packaging of cups of SUSE Linux Enterprise Server     11-SP4-LTSS, SUSE Manager Server 4.0, SUSE OpenStack Cloud Crowbar 9; openSUSE Leap 15.2, Factory allows     local attackers with control of the lp users to create files as root with 0644 permissions without the     ability to set the content. This issue affects: SUSE Linux Enterprise Server 11-SP4-LTSS cups versions     prior to 1.3.9. SUSE Manager Server 4.0 cups versions prior to 2.2.7. SUSE OpenStack Cloud Crowbar 9 cups     versions prior to 1.7.5. openSUSE Leap 15.2 cups versions prior to 2.2.7. openSUSE Factory cups version     2.3.3op2-2.1 and prior versions. (CVE-2021-25317)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the cups packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - A Incorrect Default Permissions vulnerability in the     packaging of cups of SUSE Linux Enterprise Server     11-SP4-LTSS, SUSE Manager Server 4.0, SUSE OpenStack     Cloud Crowbar 9 openSUSE Leap 15.2, Factory allows     local attackers with control of the lp users to create     files as root with 0644 permissions without the ability     to set the content.(CVE-2021-25317)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the cups packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - A Incorrect Default Permissions vulnerability in the     packaging of cups of SUSE Linux Enterprise Server     11-SP4-LTSS, SUSE Manager Server 4.0, SUSE OpenStack     Cloud Crowbar 9 openSUSE Leap 15.2, Factory allows     local attackers with control of the lp users to create     files as root with 0644 permissions without the ability     to set the content. This issue affects: SUSE Linux     Enterprise Server 11-SP4-LTSS cups versions prior to     1.3.9. SUSE Manager Server 4.0 cups versions prior to     2.2.7. SUSE OpenStack Cloud Crowbar 9 cups versions     prior to 1.7.5. openSUSE Leap 15.2 cups versions prior     to 2.2.7. openSUSE Factory cups version 2.3.3op2-2.1     and prior versions.(CVE-2021-25317)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the cups packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - A Incorrect Default Permissions vulnerability in the     packaging of cups of SUSE Linux Enterprise Server     11-SP4-LTSS, SUSE Manager Server 4.0, SUSE OpenStack     Cloud Crowbar 9 openSUSE Leap 15.2, Factory allows     local attackers with control of the lp users to create     files as root with 0644 permissions without the ability     to set the content. This issue affects: SUSE Linux     Enterprise Server 11-SP4-LTSS cups versions prior to     1.3.9. SUSE Manager Server 4.0 cups versions prior to     2.2.7. SUSE OpenStack Cloud Crowbar 9 cups versions     prior to 1.7.5. openSUSE Leap 15.2 cups versions prior     to 2.2.7. openSUSE Factory cups version 2.3.3op2-2.1     and prior versions(CVE-2021-25317)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the cups package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - A Incorrect Default Permissions vulnerability in the     packaging of cups of SUSE Linux Enterprise Server     11-SP4-LTSS, SUSE Manager Server 4.0, SUSE OpenStack     Cloud Crowbar 9 openSUSE Leap 15.2, Factory allows     local attackers with control of the lp users to create     files as root with 0644 permissions without the ability     to set the content. This issue affects: SUSE Linux     Enterprise Server 11-SP4-LTSS cups versions prior to     1.3.9. SUSE Manager Server 4.0 cups versions prior to     2.2.7. SUSE OpenStack Cloud Crowbar 9 cups versions     prior to 1.7.5. openSUSE Leap 15.2 cups versions prior     to 2.2.7. openSUSE Factory cups version 2.3.3op2-2.1     and prior versions.(CVE-2021-25317)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the cups package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability :

  - A Incorrect Default Permissions vulnerability in the     packaging of cups of SUSE Linux Enterprise Server     11-SP4-LTSS, SUSE Manager Server 4.0, SUSE OpenStack     Cloud Crowbar 9 openSUSE Leap 15.2, Factory allows     local attackers with control of the lp users to create     files as root with 0644 permissions without the ability     to set the content. This issue affects: SUSE Linux     Enterprise Server 11-SP4-LTSS cups versions prior to     1.3.9. SUSE Manager Server 4.0 cups versions prior to     2.2.7. SUSE OpenStack(CVE-2021-25317)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the cups package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - In macOS High Sierra before 10.13.5, an issue existed     in CUPS. This issue was addressed with improved access     restrictions.(CVE-2018-4181)

  - It was discovered that CUPS allows non-root users to     pass environment variables to CUPS backends. Affected     backends use attacker-controlled environment variables     without proper sanitization. A local attacker, who is     part of one of the groups specified in the SystemGroups     directive, could use the cupsctl binary to set SetEnv     and PassEnv directives and potentially controls the     flow of the affected backend, resulting in some cases     in arbitrary code execution with root     privileges.(CVE-2018-4180)

  - A Incorrect Default Permissions vulnerability in the     packaging of cups of SUSE Linux Enterprise Server     11-SP4-LTSS, SUSE Manager Server 4.0, SUSE OpenStack     Cloud Crowbar 9 openSUSE Leap 15.2, Factory allows     local attackers with control of the lp users to create     files as root with 0644 permissions without the ability     to set the content. This issue affects: SUSE Linux     Enterprise Server 11-SP4-LTSS cups versions prior to     1.3.9. SUSE Manager Server 4.0 cups versions prior to     2.2.7. SUSE OpenStack Cloud Crowbar 9 cups versions     prior to 1.7.5. openSUSE Leap 15.2 cups versions prior     to 2.2.7. openSUSE Factory cups version 2.3.3op2-2.1     and prior versions.(CVE-2021-25317)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote SUSE Linux SLES11 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2021:14712-1 advisory.

  - A Incorrect Default Permissions vulnerability in the packaging of cups of SUSE Linux Enterprise Server     11-SP4-LTSS, SUSE Manager Server 4.0, SUSE OpenStack Cloud Crowbar 9; openSUSE Leap 15.2, Factory allows     local attackers with control of the lp users to create files as root with 0644 permissions without the     ability to set the content. This issue affects: SUSE Linux Enterprise Server 11-SP4-LTSS cups versions     prior to 1.3.9. SUSE Manager Server 4.0 cups versions prior to 2.2.7. SUSE OpenStack Cloud Crowbar 9 cups     versions prior to 1.7.5. openSUSE Leap 15.2 cups versions prior to 2.2.7. openSUSE Factory cups version     2.3.3op2-2.1 and prior versions. (CVE-2021-25317)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for cups fixes the following issues :

  - CVE-2021-25317: ownership of /var/log/cups could allow     privilege escalation from lp user to root via symlink     attacks (bsc#1184161)

This update was imported from the SUSE:SLE-15:Update update project.

This update for cups fixes the following issues :

CVE-2021-25317: ownership of /var/log/cups could allow privilege escalation from lp user to root via symlink attacks (bsc#1184161)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
196342	RHEL 6 : cups (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
157979	EulerOS Virtualization 3.0.6.0 : cups (EulerOS-SA-2022-1061)	Nessus	Huawei Local Security Checks	low
157956	EulerOS Virtualization 3.0.6.6 : cups (EulerOS-SA-2022-1115)	Nessus	Huawei Local Security Checks	medium
156500	EulerOS Virtualization 3.0.2.6 : cups (EulerOS-SA-2021-2898)	Nessus	Huawei Local Security Checks	medium
153298	EulerOS 2.0 SP2 : cups (EulerOS-SA-2021-2363)	Nessus	Huawei Local Security Checks	low
153070	EulerOS 2.0 SP5 : cups (EulerOS-SA-2021-2324)	Nessus	Huawei Local Security Checks	low
152344	EulerOS 2.0 SP8 : cups (EulerOS-SA-2021-2289)	Nessus	Huawei Local Security Checks	low
152296	EulerOS 2.0 SP9 : cups (EulerOS-SA-2021-2264)	Nessus	Huawei Local Security Checks	low
152279	EulerOS 2.0 SP9 : cups (EulerOS-SA-2021-2238)	Nessus	Huawei Local Security Checks	low
151559	EulerOS Virtualization 2.9.0 : cups (EulerOS-SA-2021-2203)	Nessus	Huawei Local Security Checks	low
151552	EulerOS Virtualization 2.9.1 : cups (EulerOS-SA-2021-2190)	Nessus	Huawei Local Security Checks	low
151308	EulerOS Virtualization for ARM 64 3.0.2.0 : cups (EulerOS-SA-2021-2120)	Nessus	Huawei Local Security Checks	high
150572	SUSE SLES11 Security Update : cups (SUSE-SU-2021:14712-1)	Nessus	SuSE Local Security Checks	low
149557	openSUSE Security Update : cups (openSUSE-2021-638)	Nessus	SuSE Local Security Checks	low
149230	SUSE SLES12 Security Update : cups (SUSE-SU-2021:1453-1)	Nessus	SuSE Local Security Checks	low
149225	SUSE SLED15 / SLES15 Security Update : cups (SUSE-SU-2021:1454-1)	Nessus	SuSE Local Security Checks	low

Detections

Analytics

CVE-2021-25317

low

Tenable Plugins

high

low

medium

medium

low

low

low

low

low

low

low

high

low

low

low

low