Mandriva Linux Security Advisory : cups (MDVSA-2008:036)

High Nessus Plugin ID 37571


The remote Mandriva Linux host is missing one or more security updates.


Wei Wang found that the SNMP discovery backend in CUPS did not correctly calculate the length of strings. If a user could be tricked into scanning for printers, a remote attacker could send a specially crafted packet and possibly execute arbitrary code (CVE-2007-5849).

As well, the fix for CVE-2007-0720 in MDKSA-2007:086 caused another denial of service regression within SSL handling (CVE-2007-4045).

The updated packages have been patched to correct these issues.


Update the affected packages.

Plugin Details

Severity: High

ID: 37571

File Name: mandriva_MDVSA-2008-036.nasl

Version: $Revision: 1.11 $

Type: local

Published: 2009/04/23

Modified: 2013/06/01

Dependencies: 12634

Risk Information

Risk Factor: High


Base Score: 9.3

Vector: CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C

Vulnerability Information

CPE: p-cpe:/a:mandriva:linux:cups, p-cpe:/a:mandriva:linux:cups-common, p-cpe:/a:mandriva:linux:cups-serial, p-cpe:/a:mandriva:linux:lib64cups2, p-cpe:/a:mandriva:linux:lib64cups2-devel, p-cpe:/a:mandriva:linux:libcups2, p-cpe:/a:mandriva:linux:libcups2-devel, p-cpe:/a:mandriva:linux:php-cups, cpe:/o:mandriva:linux:2007, cpe:/o:mandriva:linux:2007.1, cpe:/o:mandriva:linux:2008.0

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/Mandrake/release, Host/Mandrake/rpm-list

Patch Publication Date: 2008/02/06

Reference Information

CVE: CVE-2007-4045, CVE-2007-5849

MDVSA: 2008:036

CWE: 189