ID CVE-2010-0540
Summary Cross-site request forgery (CSRF) vulnerability in the web interface in CUPS before 1.4.4, as used on Apple Mac OS X 10.5.8, Mac OS X 10.6 before 10.6.4, and other platforms, allows remote attackers to hijack the authentication of administrators for requests that change settings.
References
Vulnerable Configurations
  • Apple Mac OS X 10.5.8
    cpe:2.3:o:apple:mac_os_x:10.5.8
  • Apple Mac OS X 10.6.0
    cpe:2.3:o:apple:mac_os_x:10.6.0
  • Apple Mac OS X 10.6.1
    cpe:2.3:o:apple:mac_os_x:10.6.1
  • Apple Mac OS X 10.6.2
    cpe:2.3:o:apple:mac_os_x:10.6.2
  • Apple Mac OS X 10.6.3
    cpe:2.3:o:apple:mac_os_x:10.6.3
  • Apple Mac OS X Server 10.5.8
    cpe:2.3:o:apple:mac_os_x_server:10.5.8
  • Apple Mac OS X Server 10.6.0
    cpe:2.3:o:apple:mac_os_x_server:10.6.0
  • Apple Mac OS X Server 10.6.1
    cpe:2.3:o:apple:mac_os_x_server:10.6.1
  • Apple Mac OS X Server 10.6.2
    cpe:2.3:o:apple:mac_os_x_server:10.6.2
  • Apple Mac OS X Server 10.6.3
    cpe:2.3:o:apple:mac_os_x_server:10.6.3
CVSS
Base: 6.0 (as of 17-06-2010 - 16:53)
Impact:
Exploitability:
CWE CWE-352
CAPEC
  • JSON Hijacking (aka JavaScript Hijacking)
    An attacker targets a system that uses JavaScript Object Notation (JSON) as a transport mechanism between the client and the server (common in Web 2.0 systems using AJAX) to steal possibly confidential information transmitted from the server back to the client inside the JSON object by taking advantage of the loophole in the browser's Same Origin Policy that does not prohibit JavaScript from one website to be included and executed in the context of another website. An attacker gets the victim to visit his or her malicious page that contains a script tag whose source points to the vulnerable system with a URL that requests a response from the server containing a JSON object with possibly confidential information. The malicious page also contains malicious code to capture the JSON object returned by the server before any other processing on it can take place, typically by overriding the JavaScript function used to create new objects. This hook allows the malicious code to get access to the creation of each object and transmit the possibly sensitive contents of the captured JSON object to the attackers' server. There is nothing in the browser's security model to prevent the attackers' malicious JavaScript code (originating from attacker's domain) to set up an environment (as described above) to intercept a JSON object response (coming from the vulnerable target system's domain), read its contents and transmit to the attackers' controlled site. The same origin policy protects the domain object model (DOM), but not the JSON.
  • Cross-Domain Search Timing
    An attacker initiates cross domain HTTP / GET requests and times the server responses. The timing of these responses may leak important information on what is happening on the server. Browser's same origin policy prevents the attacker from directly reading the server responses (in the absence of any other weaknesses), but does not prevent the attacker from timing the responses to requests that the attacker issued cross domain. For GET requests an attacker could for instance leverage the "img" tag in conjunction with "onload() / onerror()" javascript events. For the POST requests, an attacker could leverage the "iframe" element and leverage the "onload()" event. There is nothing in the current browser security model that prevents an attacker to use these methods to time responses to the attackers' cross domain requests. The timing for these responses leaks information. For instance, if a victim has an active session with their online e-mail account, an attacker could issue search requests in the victim's mailbox. While the attacker is not able to view the responses, based on the timings of the responses, the attacker could ask yes / no questions as to the content of victim's e-mails, who the victim e-mailed, when, etc. This is but one example; There are other scenarios where an attacker could infer potentially sensitive information from cross domain requests by timing the responses while asking the right questions that leak information.
  • Cross Site Identification
    An attacker harvests identifying information about a victim via an active session that the victim's browser has with a social networking site. A victim may have the social networking site open in one tab or perhaps is simply using the "remember me" feature to keep his or her session with the social networking site active. An attacker induces a payload to execute in the victim's browser that transparently to the victim initiates a request to the social networking site (e.g., via available social network site APIs) to retrieve identifying information about a victim. While some of this information may be public, the attacker is able to harvest this information in context and may use it for further attacks on the user (e.g., spear phishing). In one example of an attack, an attacker may post a malicious posting that contains an image with an embedded link. The link actually requests identifying information from the social networking site. A victim who views the malicious posting in his or her browser will have sent identifying information to the attacker, as long as the victim had an active session with the social networking site. There are many other ways in which the attacker may get the payload to execute in the victim's browser mainly by finding a way to hide it in some reputable site that the victim visits. The attacker could also send the link to the victim in an e-mail and trick the victim into clicking on the link. This attack is basically a cross site request forgery attack with two main differences. First, there is no action that is performed on behalf of the user aside from harvesting information. So standard CSRF protection may not work in this situation. Second, what is important in this attack pattern is the nature of the data being harvested, which is identifying information that can be obtained and used in context. This real time harvesting of identifying information can be used as a prelude for launching real time targeted social engineering attacks on the victim.
  • Cross Site Request Forgery (aka Session Riding)
    An attacker crafts malicious web links and distributes them (via web pages, email, etc.), typically in a targeted manner, hoping to induce users to click on the link and execute the malicious action against some third-party application. If successful, the action embedded in the malicious link will be processed and accepted by the targeted application with the users' privilege level. This type of attack leverages the persistence and implicit trust placed in user session cookies by many web applications today. In such an architecture, once the user authenticates to an application and a session cookie is created on the user's system, all following transactions for that session are authenticated using that cookie including potential actions initiated by an attacker and simply "riding" the existing session cookie.
Access
VectorComplexityAuthentication
NETWORK MEDIUM SINGLE_INSTANCE
Impact
ConfidentialityIntegrityAvailability
PARTIAL PARTIAL PARTIAL
nessus via4
  • NASL family MacOS X Local Security Checks
    NASL id MACOSX_SECUPD2010-004.NASL
    description The remote host is running a version of Mac OS X 10.5 that does not have Security Update 2010-004 applied. This security update contains fixes for the following components : - CUPS - DesktopServices - Flash Player plug-in - Folder Manager - iChat - ImageIO - Kerberos - Kernel - libcurl - Network Authorization - Ruby - SMB File Server - SquirrelMail - Wiki Server
    last seen 2019-02-21
    modified 2018-07-14
    plugin id 47024
    published 2010-06-15
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=47024
    title Mac OS X Multiple Vulnerabilities (Security Update 2010-004)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_11_CUPS-110921.NASL
    description This update fixes the following security issues : - 601830: CSRF via admin web interface. (CVE-2010-0540) - 680210: users in group 'lp' can overwrite arbitrary files. (CVE-2010-2431) - 680212: denial of service via cupsDoAuthentication. (CVE-2010-2432) - 711490: heap overflow in gif decoder. (CVE-2011-2896) - 715643: heap overflow in gif decoder (CVE-2011-3170)
    last seen 2019-02-21
    modified 2013-10-25
    plugin id 57094
    published 2011-12-13
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=57094
    title SuSE 11.1 Security Update : CUPS (SAT Patch Number 5180)
  • NASL family Mandriva Local Security Checks
    NASL id MANDRIVA_MDVSA-2010-232.NASL
    description Multiple vulnerabilities were discovered and corrected in cups : Cross-site request forgery (CSRF) vulnerability in the web interface in CUPS, allows remote attackers to hijack the authentication of administrators for requests that change settings (CVE-2010-0540). The _WriteProlog function in texttops.c in texttops in the Text Filter subsystem in CUPS before 1.4.4 does not check the return values of certain calloc calls, which allows remote attackers to cause a denial of service (NULL pointer dereference or heap memory corruption) or possibly execute arbitrary code via a crafted file (CVE-2010-0542). The web interface in CUPS, reads uninitialized memory during handling of form variables, which allows context-dependent attackers to obtain sensitive information from cupsd process memory via unspecified vectors (CVE-2010-1748). The cupsFileOpen function in CUPS before 1.4.4 allows local users, with lp group membership, to overwrite arbitrary files via a symlink attack on the (1) /var/cache/cups/remote.cache or (2) /var/cache/cups/job.cache file (CVE-2010-2431). ipp.c in cupsd in CUPS 1.4.4 and earlier does not properly allocate memory for attribute values with invalid string data types, which allows remote attackers to cause a denial of service (use-after-free and application crash) or possibly execute arbitrary code via a crafted IPP request (CVE-2010-2941). Packages for 2009.0 are provided as of the Extended Maintenance Program. Please visit this link to learn more: http://store.mandriva.com/product_info.php?cPath=149&products_id=4 90 The updated packages have been patched to correct these issues.
    last seen 2019-02-21
    modified 2018-07-19
    plugin id 50606
    published 2010-11-16
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=50606
    title Mandriva Linux Security Advisory : cups (MDVSA-2010:232)
  • NASL family Misc.
    NASL id CUPS_1_4_4.NASL
    description According to its banner, the version of CUPS installed on the remote host is earlier than 1.4.4. Such versions are affected by several vulnerabilities : - The patch for STR #3200 / CVE-2009-3553 was not complete. A remote client can cause a denial of service by causing the CUPS server to reference an already freed resource. (STR #3490) (CVE-2010-0302) - The CUPS daemon may be vulnerable to certain cross-site request forgery (CSRF) attacks, e.g., malicious IFRAME attacks. (STR #3498) (CVE-2010-0540) - An unprivileged process may be able to cause the CUPS server to overwrite arbitrary files as the root user. (STR #3510) (CVE-2010-2431) - The CUPS daemon is vulnerable to a heap corruption attack as the 'textops' filter does not verify the results of memory allocations. It is possible this may lead to arbitrary code execution. (STR #3516) (CVE-2010-0542) - The CUPS daemon is vulnerable to a denial of service attack if compiled without HAVE_GSSAPI. (STR #3518) (CVE-2010-2432) - The CUPS daemon is vulnerable to an information disclosure attack as an attacker can view portions of uninitialized memory by a specially crafted URL. (STR #3577) (CVE-2010-1748)
    last seen 2019-02-21
    modified 2018-07-06
    plugin id 47683
    published 2010-07-08
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=47683
    title CUPS < 1.4.4 Multiple Vulnerabilities
  • NASL family Fedora Local Security Checks
    NASL id FEDORA_2010-10066.NASL
    description New upstream release fixing several security issues: CVE-2010-0540, CVE-2010-0542, CVE-2010-1748. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2015-10-20
    plugin id 47206
    published 2010-07-01
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=47206
    title Fedora 11 : cups-1.4.4-4.fc11 (2010-10066)
  • NASL family Oracle Linux Local Security Checks
    NASL id ORACLELINUX_ELSA-2010-0490.NASL
    description From Red Hat Security Advisory 2010:0490 : Updated cups packages that fix three security issues are now available for Red Hat Enterprise Linux 3, 4, and 5. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. The Common UNIX Printing System (CUPS) provides a portable printing layer for UNIX operating systems. The CUPS 'texttops' filter converts text files to PostScript. A missing memory allocation failure check flaw, leading to a NULL pointer dereference, was found in the CUPS 'texttops' filter. An attacker could create a malicious text file that would cause 'texttops' to crash or, potentially, execute arbitrary code as the 'lp' user if the file was printed. (CVE-2010-0542) A Cross-Site Request Forgery (CSRF) issue was found in the CUPS web interface. If a remote attacker could trick a user, who is logged into the CUPS web interface as an administrator, into visiting a specially crafted website, the attacker could reconfigure and disable CUPS, and gain access to print jobs and system files. (CVE-2010-0540) Note: As a result of the fix for CVE-2010-0540, cookies must now be enabled in your web browser to use the CUPS web interface. An uninitialized memory read issue was found in the CUPS web interface. If an attacker had access to the CUPS web interface, they could use a specially crafted URL to leverage this flaw to read a limited amount of memory from the cupsd process, possibly obtaining sensitive information. (CVE-2010-1748) Red Hat would like to thank the Apple Product Security team for responsibly reporting these issues. Upstream acknowledges regenrecht as the original reporter of CVE-2010-0542; Adrian 'pagvac' Pastor of GNUCITIZEN and Tim Starling as the original reporters of CVE-2010-0540; and Luca Carettoni as the original reporter of CVE-2010-1748. Users of cups are advised to upgrade to these updated packages, which contain backported patches to correct these issues. After installing this update, the cupsd daemon will be restarted automatically.
    last seen 2019-02-21
    modified 2015-12-01
    plugin id 68052
    published 2013-07-12
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=68052
    title Oracle Linux 3 / 4 / 5 : cups (ELSA-2010-0490)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_CUPS-7774.NASL
    description This update fixes the following security issues : - 601830: CSRF via admin web interface. (CVE-2010-0540) - 680210: users in group 'lp' can overwrite arbitrary files. (CVE-2010-2431) - 711490: heap overflow in gif decoder. (CVE-2011-2896) - 715643: heap overflow in gif decoder (CVE-2011-3170) This update also fixes the following non-security issues : - 671735: CUPS backends do not clear messages like 'Waiting for printer to finish...'
    last seen 2019-02-21
    modified 2012-10-03
    plugin id 56603
    published 2011-10-24
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=56603
    title SuSE 10 Security Update : CUPS (ZYPP Patch Number 7774)
  • NASL family Mandriva Local Security Checks
    NASL id MANDRIVA_MDVSA-2010-233.NASL
    description Multiple vulnerabilities were discovered and corrected in cups : Cross-site request forgery (CSRF) vulnerability in the web interface in CUPS, allows remote attackers to hijack the authentication of administrators for requests that change settings (CVE-2010-0540). ipp.c in cupsd in CUPS 1.4.4 and earlier does not properly allocate memory for attribute values with invalid string data types, which allows remote attackers to cause a denial of service (use-after-free and application crash) or possibly execute arbitrary code via a crafted IPP request (CVE-2010-2941). The updated packages have been patched to correct these issues.
    last seen 2019-02-21
    modified 2018-07-19
    plugin id 50607
    published 2010-11-16
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=50607
    title Mandriva Linux Security Advisory : cups (MDVSA-2010:233)
  • NASL family MacOS X Local Security Checks
    NASL id MACOSX_10_6_4.NASL
    description The remote host is running a version of Mac OS X 10.6.x that is prior to 10.6.4. Mac OS X 10.6.4 contains security fixes for the following components : - CUPS - DesktopServices - Flash Player plug-in - Folder Manager - Help Viewer - iChat - ImageIO - Kerberos - Kernel - libcurl - Network Authorization - Open Directory - Printer Setup - Printing - Ruby - SMB File Server - SquirrelMail - Wiki Server
    last seen 2019-02-21
    modified 2018-07-14
    plugin id 47023
    published 2010-06-15
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=47023
    title Mac OS X 10.6.x < 10.6.4 Multiple Vulnerabilities
  • NASL family SuSE Local Security Checks
    NASL id SUSE_CUPS-7775.NASL
    description This update fixes the following security issues : - 601830: CSRF via admin web interface. (CVE-2010-0540) - 680210: users in group 'lp' can overwrite arbitrary files. (CVE-2010-2431) - 711490: heap overflow in gif decoder. (CVE-2011-2896) - 715643: heap overflow in gif decoder (CVE-2011-3170) This update also fixes the following non-security issues : - 671735: CUPS backends do not clear messages like 'Waiting for printer to finish...'
    last seen 2019-02-21
    modified 2012-10-03
    plugin id 57172
    published 2011-12-13
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=57172
    title SuSE 10 Security Update : CUPS (ZYPP Patch Number 7775)
  • NASL family Debian Local Security Checks
    NASL id DEBIAN_DSA-2176.NASL
    description Several vulnerabilities have been discovered in the Common UNIX Printing System : - CVE-2008-5183 A NULL pointer dereference in RSS job completion notifications could lead to denial of service. - CVE-2009-3553 It was discovered that incorrect file descriptor handling could lead to denial of service. - CVE-2010-0540 A cross-site request forgery vulnerability was discovered in the web interface. - CVE-2010-0542 Incorrect memory management in the filter subsystem could lead to denial of service. - CVE-2010-1748 Information disclosure in the web interface. - CVE-2010-2431 Emmanuel Bouillon discovered a symlink vulnerability in handling of cache files. - CVE-2010-2432 Denial of service in the authentication code. - CVE-2010-2941 Incorrect memory management in the IPP code could lead to denial of service or the execution of arbitrary code.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 52484
    published 2011-03-02
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=52484
    title Debian DSA-2176-1 : cups - several vulnerabilities
  • NASL family Slackware Local Security Checks
    NASL id SLACKWARE_SSA_2010-176-05.NASL
    description New cups packages are available for Slackware 13.1 and -current to fix security issues.
    last seen 2019-02-21
    modified 2013-06-01
    plugin id 54882
    published 2011-05-28
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=54882
    title Slackware 13.1 / current : cups (SSA:2010-176-05)
  • NASL family Gentoo Local Security Checks
    NASL id GENTOO_GLSA-201207-10.NASL
    description The remote host is affected by the vulnerability described in GLSA-201207-10 (CUPS: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in CUPS. Please review the CVE identifiers referenced below for details. Impact : A remote attacker may be able to execute arbitrary code using specially crafted streams, IPP requests or files, or cause a Denial of Service (daemon crash or hang). A local attacker may be able to gain escalated privileges or overwrite arbitrary files. Furthermore, a remote attacker may be able to obtain sensitive information from the CUPS process or hijack a CUPS administrator authentication request. Workaround : There is no known workaround at this time.
    last seen 2019-02-21
    modified 2016-11-11
    plugin id 59902
    published 2012-07-10
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=59902
    title GLSA-201207-10 : CUPS: Multiple vulnerabilities
  • NASL family Scientific Linux Local Security Checks
    NASL id SL_20100617_CUPS_ON_SL3_X.NASL
    description A missing memory allocation failure check flaw, leading to a NULL pointer dereference, was found in the CUPS 'texttops' filter. An attacker could create a malicious text file that would cause 'texttops' to crash or, potentially, execute arbitrary code as the 'lp' user if the file was printed. (CVE-2010-0542) A Cross-Site Request Forgery (CSRF) issue was found in the CUPS web interface. If a remote attacker could trick a user, who is logged into the CUPS web interface as an administrator, into visiting a specially crafted website, the attacker could reconfigure and disable CUPS, and gain access to print jobs and system files. (CVE-2010-0540) Note: As a result of the fix for CVE-2010-0540, cookies must now be enabled in your web browser to use the CUPS web interface. An uninitialized memory read issue was found in the CUPS web interface. If an attacker had access to the CUPS web interface, they could use a specially crafted URL to leverage this flaw to read a limited amount of memory from the cupsd process, possibly obtaining sensitive information. (CVE-2010-1748) After installing this update, the cupsd daemon will be restarted automatically.
    last seen 2019-02-21
    modified 2019-01-02
    plugin id 60806
    published 2012-08-01
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=60806
    title Scientific Linux Security Update : cups on SL3.x, SL4.x, SL5.x i386/x86_64
  • NASL family Ubuntu Local Security Checks
    NASL id UBUNTU_USN-952-1.NASL
    description Adrian Pastor and Tim Starling discovered that the CUPS web interface incorrectly protected against cross-site request forgery (CSRF) attacks. If an authenticated user were tricked into visiting a malicious website while logged into CUPS, a remote attacker could modify the CUPS configuration and possibly steal confidential data. (CVE-2010-0540) It was discovered that CUPS did not properly handle memory allocations in the texttops filter. If a user or automated system were tricked into printing a crafted text file, a remote attacker could cause a denial of service or possibly execute arbitrary code with privileges of the CUPS user (lp). (CVE-2010-0542) Luca Carettoni discovered that the CUPS web interface incorrectly handled form variables. A remote attacker who had access to the CUPS web interface could use this flaw to read a limited amount of memory from the cupsd process and possibly obtain confidential data. (CVE-2010-1748). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-11-28
    plugin id 47108
    published 2010-06-22
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=47108
    title Ubuntu 6.06 LTS / 8.04 LTS / 9.04 / 9.10 / 10.04 LTS : cups, cupsys vulnerabilities (USN-952-1)
  • NASL family Fedora Local Security Checks
    NASL id FEDORA_2010-10388.NASL
    description New upstream release fixing several security issues: CVE-2010-0540, CVE-2010-0542, CVE-2010-1748. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2015-10-20
    plugin id 47586
    published 2010-07-02
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=47586
    title Fedora 13 : cups-1.4.4-5.fc13 (2010-10388)
  • NASL family CentOS Local Security Checks
    NASL id CENTOS_RHSA-2010-0490.NASL
    description Updated cups packages that fix three security issues are now available for Red Hat Enterprise Linux 3, 4, and 5. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. The Common UNIX Printing System (CUPS) provides a portable printing layer for UNIX operating systems. The CUPS 'texttops' filter converts text files to PostScript. A missing memory allocation failure check flaw, leading to a NULL pointer dereference, was found in the CUPS 'texttops' filter. An attacker could create a malicious text file that would cause 'texttops' to crash or, potentially, execute arbitrary code as the 'lp' user if the file was printed. (CVE-2010-0542) A Cross-Site Request Forgery (CSRF) issue was found in the CUPS web interface. If a remote attacker could trick a user, who is logged into the CUPS web interface as an administrator, into visiting a specially crafted website, the attacker could reconfigure and disable CUPS, and gain access to print jobs and system files. (CVE-2010-0540) Note: As a result of the fix for CVE-2010-0540, cookies must now be enabled in your web browser to use the CUPS web interface. An uninitialized memory read issue was found in the CUPS web interface. If an attacker had access to the CUPS web interface, they could use a specially crafted URL to leverage this flaw to read a limited amount of memory from the cupsd process, possibly obtaining sensitive information. (CVE-2010-1748) Red Hat would like to thank the Apple Product Security team for responsibly reporting these issues. Upstream acknowledges regenrecht as the original reporter of CVE-2010-0542; Adrian 'pagvac' Pastor of GNUCITIZEN and Tim Starling as the original reporters of CVE-2010-0540; and Luca Carettoni as the original reporter of CVE-2010-1748. Users of cups are advised to upgrade to these updated packages, which contain backported patches to correct these issues. After installing this update, the cupsd daemon will be restarted automatically.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 47102
    published 2010-06-21
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=47102
    title CentOS 3 / 4 / 5 : cups (CESA-2010:0490)
  • NASL family Fedora Local Security Checks
    NASL id FEDORA_2010-10101.NASL
    description New upstream release fixing several security issues: CVE-2010-0540, CVE-2010-0542, CVE-2010-1748. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2015-10-20
    plugin id 47835
    published 2010-07-27
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=47835
    title Fedora 12 : cups-1.4.4-5.fc12 (2010-10101)
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2010-0490.NASL
    description Updated cups packages that fix three security issues are now available for Red Hat Enterprise Linux 3, 4, and 5. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. The Common UNIX Printing System (CUPS) provides a portable printing layer for UNIX operating systems. The CUPS 'texttops' filter converts text files to PostScript. A missing memory allocation failure check flaw, leading to a NULL pointer dereference, was found in the CUPS 'texttops' filter. An attacker could create a malicious text file that would cause 'texttops' to crash or, potentially, execute arbitrary code as the 'lp' user if the file was printed. (CVE-2010-0542) A Cross-Site Request Forgery (CSRF) issue was found in the CUPS web interface. If a remote attacker could trick a user, who is logged into the CUPS web interface as an administrator, into visiting a specially crafted website, the attacker could reconfigure and disable CUPS, and gain access to print jobs and system files. (CVE-2010-0540) Note: As a result of the fix for CVE-2010-0540, cookies must now be enabled in your web browser to use the CUPS web interface. An uninitialized memory read issue was found in the CUPS web interface. If an attacker had access to the CUPS web interface, they could use a specially crafted URL to leverage this flaw to read a limited amount of memory from the cupsd process, possibly obtaining sensitive information. (CVE-2010-1748) Red Hat would like to thank the Apple Product Security team for responsibly reporting these issues. Upstream acknowledges regenrecht as the original reporter of CVE-2010-0542; Adrian 'pagvac' Pastor of GNUCITIZEN and Tim Starling as the original reporters of CVE-2010-0540; and Luca Carettoni as the original reporter of CVE-2010-1748. Users of cups are advised to upgrade to these updated packages, which contain backported patches to correct these issues. After installing this update, the cupsd daemon will be restarted automatically.
    last seen 2019-02-21
    modified 2018-11-28
    plugin id 47044
    published 2010-06-18
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=47044
    title RHEL 3 / 4 / 5 : cups (RHSA-2010:0490)
oval via4
accepted 2013-04-29T04:05:11.142-04:00
class vulnerability
contributors
  • name Aharon Chernin
    organization SCAP.com, LLC
  • name Dragos Prisaca
    organization G2, Inc.
definition_extensions
  • comment The operating system installed on the system is Red Hat Enterprise Linux 3
    oval oval:org.mitre.oval:def:11782
  • comment CentOS Linux 3.x
    oval oval:org.mitre.oval:def:16651
  • comment The operating system installed on the system is Red Hat Enterprise Linux 4
    oval oval:org.mitre.oval:def:11831
  • comment CentOS Linux 4.x
    oval oval:org.mitre.oval:def:16636
  • comment Oracle Linux 4.x
    oval oval:org.mitre.oval:def:15990
  • comment The operating system installed on the system is Red Hat Enterprise Linux 5
    oval oval:org.mitre.oval:def:11414
  • comment The operating system installed on the system is CentOS Linux 5.x
    oval oval:org.mitre.oval:def:15802
  • comment Oracle Linux 5.x
    oval oval:org.mitre.oval:def:15459
description Cross-site request forgery (CSRF) vulnerability in the web interface in CUPS before 1.4.4, as used on Apple Mac OS X 10.5.8, Mac OS X 10.6 before 10.6.4, and other platforms, allows remote attackers to hijack the authentication of administrators for requests that change settings.
family unix
id oval:org.mitre.oval:def:10382
status accepted
submitted 2010-07-09T03:56:16-04:00
title Cross-site request forgery (CSRF) vulnerability in the web interface in CUPS before 1.4.4, as used on Apple Mac OS X 10.5.8, Mac OS X 10.6 before 10.6.4, and other platforms, allows remote attackers to hijack the authentication of administrators for requests that change settings.
version 24
redhat via4
rpms
  • cups-1:1.1.17-13.3.65
  • cups-devel-1:1.1.17-13.3.65
  • cups-libs-1:1.1.17-13.3.65
  • cups-1:1.1.22-0.rc1.9.32.el4_8.6
  • cups-devel-1:1.1.22-0.rc1.9.32.el4_8.6
  • cups-libs-1:1.1.22-0.rc1.9.32.el4_8.6
  • cups-1:1.3.7-18.el5_5.4
  • cups-devel-1:1.3.7-18.el5_5.4
  • cups-libs-1:1.3.7-18.el5_5.4
  • cups-lpd-1:1.3.7-18.el5_5.4
refmap via4
apple APPLE-SA-2010-06-15-1
bid 40871
confirm
debian DSA-2176
gentoo GLSA-201207-10
mandriva
  • MDVSA-2010:232
  • MDVSA-2010:233
  • MDVSA-2010:234
sectrack 1024122
secunia
  • 40220
  • 43521
vupen
  • ADV-2010-1481
  • ADV-2011-0535
Last major update 14-05-2013 - 23:06
Published 17-06-2010 - 12:30
Last modified 18-09-2017 - 21:30
Back to Top