CVE-2010-0302 - Use-after-free vulnerability in the abstract file-descriptor handling interface in the cupsdDoSelect

CVE-2010-0302

Summary

Use-after-free vulnerability in the abstract file-descriptor handling interface in the cupsdDoSelect function in scheduler/select.c in the scheduler in cupsd in CUPS before 1.4.4, when kqueue or epoll is used, allows remote attackers to cause a denial of service (daemon crash or hang) via a client disconnection during listing of a large number of print jobs, related to improperly maintaining a reference count. NOTE: some of these details are obtained from third party information. NOTE: this vulnerability exists because of an incomplete fix for CVE-2009-3553.

References

Vulnerable Configurations

cpe:2.3:a:apple:cups:1.3.7:*:*:*:*:*:*:*
cpe:2.3:a:apple:cups:1.3.7:*:*:*:*:*:*:*
cpe:2.3:a:apple:cups:1.3.9:*:*:*:*:*:*:*
cpe:2.3:a:apple:cups:1.3.9:*:*:*:*:*:*:*
cpe:2.3:a:apple:cups:1.3.10:*:*:*:*:*:*:*
cpe:2.3:a:apple:cups:1.3.10:*:*:*:*:*:*:*
cpe:2.3:a:apple:cups:1.4.1:*:*:*:*:*:*:*
cpe:2.3:a:apple:cups:1.4.1:*:*:*:*:*:*:*

CVSS

Base:	4.3 (as of 19-09-2017 - 01:30)
Impact:
Exploitability:

CWE

CWE-399

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	MEDIUM	NONE

Impact

Confidentiality	Integrity	Availability
NONE	NONE	PARTIAL

cvss-vector via4

AV:N/AC:M/Au:N/C:N/I:N/A:P

oval via4

accepted

2013-04-29T04:12:25.705-04:00

class

vulnerability

contributors

name Aharon Chernin
organization SCAP.com, LLC
name Dragos Prisaca
organization G2, Inc.

definition_extensions

comment The operating system installed on the system is Red Hat Enterprise Linux 5
oval oval:org.mitre.oval:def:11414
comment The operating system installed on the system is CentOS Linux 5.x
oval oval:org.mitre.oval:def:15802
comment Oracle Linux 5.x
oval oval:org.mitre.oval:def:15459

description

family

unix

oval:org.mitre.oval:def:11216

status

accepted

submitted

2010-07-09T03:56:16-04:00

title

version

redhat via4

advisories

bugzilla

id	557775
title	CVE-2010-0302 cups Incomplete fix for CVE-2009-3553

oval

comment Red Hat Enterprise Linux must be installed
oval oval:com.redhat.rhba:tst:20070304026

AND

comment Red Hat Enterprise Linux 5 is installed
oval oval:com.redhat.rhba:tst:20070331005

AND
comment cups is earlier than 1:1.3.7-11.el5_4.6
oval oval:com.redhat.rhsa:tst:20100129001
comment cups is signed with Red Hat redhatrelease key
oval oval:com.redhat.rhsa:tst:20070123009
AND
comment cups-devel is earlier than 1:1.3.7-11.el5_4.6
oval oval:com.redhat.rhsa:tst:20100129003
comment cups-devel is signed with Red Hat redhatrelease key
oval oval:com.redhat.rhsa:tst:20070123011
AND
comment cups-libs is earlier than 1:1.3.7-11.el5_4.6
oval oval:com.redhat.rhsa:tst:20100129005
comment cups-libs is signed with Red Hat redhatrelease key
oval oval:com.redhat.rhsa:tst:20070123013
AND
comment cups-lpd is earlier than 1:1.3.7-11.el5_4.6
oval oval:com.redhat.rhsa:tst:20100129007
comment cups-lpd is signed with Red Hat redhatrelease key
oval oval:com.redhat.rhsa:tst:20070123015

rhsa

id	RHSA-2010:0129
released	2010-03-03
severity	Moderate
title	RHSA-2010:0129: cups security update (Moderate)

rpms

cups-1:1.3.7-11.el5_4.6
cups-debuginfo-1:1.3.7-11.el5_4.6
cups-devel-1:1.3.7-11.el5_4.6
cups-libs-1:1.3.7-11.el5_4.6
cups-lpd-1:1.3.7-11.el5_4.6

refmap via4

apple	APPLE-SA-2010-06-15-1
bid	38510
confirm	http://cups.org/articles.php?L596 http://cups.org/str.php?L3490 http://support.apple.com/kb/HT4188 https://bugzilla.redhat.com/show_bug.cgi?id=557775
fedora	FEDORA-2010-2743
gentoo	GLSA-201207-10
mandriva	MDVSA-2010:073
sectrack	1024124
secunia	38785 38927 38979 40220
ubuntu	USN-906-1
vupen	ADV-2010-1481

Last major update

19-09-2017 - 01:30

Published

05-03-2010 - 19:30

Last modified

19-09-2017 - 01:30