CUPS < 1.4.3 Multiple Vulnerabilities

high Nessus Network Monitor Plugin ID 5512

Synopsis

The remote host is running a web application that is affected by multiple attack vectors.

Description

According to its banner, the version of CUPS installed on the remote host is earlier than 1.4.3. Such versions are affected by several vulnerabilities :

- A pointer use-after-free vulnerability exists in the abstract file descriptor handling code in the 'cupsdDoSelect' function in scheduler/select.c. A remote attacker may be able to leverage this to hang or crash the cupsd daemon by disconnecting while receiving a listing with a large number of print jobs. (STR #3200)

- The lppasswd utility, when its setuid bit is enabled, allows a local user to escalate his or her privileges because it uses an environment variable to override CUPS' default directories and determine the location of a file with localized message strings. (STR #3482)

Solution

Upgrade to CUPS version 1.4.3 or later.

Plugin Details

Severity: High

ID: 5512

Family: Web Servers

Published: 4/19/2010

Updated: 3/6/2019

Nessus ID: 45554

Risk Information

VPR

Risk Factor: High

Score: 7.6

Percentile: 98.67

CVSS v2

Risk Factor: Medium

Base Score: 6

Temporal Score: 5

Vector: CVSS2#AV:L/AC:H/Au:S/C:C/I:C/A:C

CVSS v3

Risk Factor: High

Base Score: 7

Temporal Score: 6.5

Vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:F/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:apple:cups

Patch Publication Date: 3/30/2010

Vulnerability Publication Date: 3/3/2010

Exploitable With

Core Impact

Reference Information

CVE: CVE-2009-3553, CVE-2010-0393

BID: 37048, 38524

Detections

Analytics