Detections
Analytics
CUPS < 1.4.3 Multiple Vulnerabilities
high Nessus Plugin ID 45554
Language:
Synopsis
The remote printer service is affected by multiple vulnerabilities.Description
According to its banner, the version of CUPS installed on the remote host is earlier than 1.4.3. Such versions are affected by several vulnerabilities :- A pointer use-after-free vulnerability exists in the abstract file descriptor handling code in the 'cupsdDoSelect' function in scheduler/select.c. A remote attacker may be able to leverage this to hang or crash the cupsd daemon by disconnecting while receiving a listing with a large number of print jobs. (STR #3200)
- The lppasswd utility, when its setuid bit is enabled, allowing a local user to elevaate privileges because it uses an environment variable to override CUPS' default directories and determine the location of a file with localized message strings. (STR #3482)
Solution
Upgrade to CUPS version 1.4.3 or later.See Also
http://www.cups.org/str.php?L3200
Plugin Details
Severity: High
ID: 45554
File Name: cups_1_4_3.nasl
Version: 1.13
Type: remote
Family: Misc.
Published: 4/16/2010
Updated: 7/6/2018
Configuration: Enable paranoid mode
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: High
Score: 7.4
CVSS v2
Risk Factor: High
Base Score: 7.2
Temporal Score: 6
Vector: CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C
Vulnerability Information
CPE: cpe:/a:apple:cups
Required KB Items: Settings/ParanoidReport, www/cups
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 3/30/2010
Vulnerability Publication Date: 3/3/2010
Exploitable With
Core Impact
Reference Information
CVE: CVE-2009-3553, CVE-2010-0393