1. CVE-Search
  2. CVE-2008-5184
ID CVE-2008-5184
Summary The web interface (cgi-bin/admin.c) in CUPS before 1.3.8 uses the guest username when a user is not logged on to the web server, which makes it easier for remote attackers to bypass intended policy and conduct CSRF attacks via the (1) add and (2) cancel RSS subscription functions.
References
Vulnerable Configurations
  • cpe:2.3:a:apple:cups:1.1:*:*:*:*:*:*:*
    cpe:2.3:a:apple:cups:1.1:*:*:*:*:*:*:*
  • cpe:2.3:a:apple:cups:1.1.1:*:*:*:*:*:*:*
    cpe:2.3:a:apple:cups:1.1.1:*:*:*:*:*:*:*
  • cpe:2.3:a:apple:cups:1.1.2:*:*:*:*:*:*:*
    cpe:2.3:a:apple:cups:1.1.2:*:*:*:*:*:*:*
  • cpe:2.3:a:apple:cups:1.1.3:*:*:*:*:*:*:*
    cpe:2.3:a:apple:cups:1.1.3:*:*:*:*:*:*:*
  • cpe:2.3:a:apple:cups:1.1.4:*:*:*:*:*:*:*
    cpe:2.3:a:apple:cups:1.1.4:*:*:*:*:*:*:*
  • cpe:2.3:a:apple:cups:1.1.5:*:*:*:*:*:*:*
    cpe:2.3:a:apple:cups:1.1.5:*:*:*:*:*:*:*
  • cpe:2.3:a:apple:cups:1.1.5-1:*:*:*:*:*:*:*
    cpe:2.3:a:apple:cups:1.1.5-1:*:*:*:*:*:*:*
  • cpe:2.3:a:apple:cups:1.1.5-2:*:*:*:*:*:*:*
    cpe:2.3:a:apple:cups:1.1.5-2:*:*:*:*:*:*:*
  • cpe:2.3:a:apple:cups:1.1.6:*:*:*:*:*:*:*
    cpe:2.3:a:apple:cups:1.1.6:*:*:*:*:*:*:*
  • cpe:2.3:a:apple:cups:1.1.6-1:*:*:*:*:*:*:*
    cpe:2.3:a:apple:cups:1.1.6-1:*:*:*:*:*:*:*
  • cpe:2.3:a:apple:cups:1.1.6-2:*:*:*:*:*:*:*
    cpe:2.3:a:apple:cups:1.1.6-2:*:*:*:*:*:*:*
  • cpe:2.3:a:apple:cups:1.1.6-3:*:*:*:*:*:*:*
    cpe:2.3:a:apple:cups:1.1.6-3:*:*:*:*:*:*:*
  • cpe:2.3:a:apple:cups:1.1.7:*:*:*:*:*:*:*
    cpe:2.3:a:apple:cups:1.1.7:*:*:*:*:*:*:*
  • cpe:2.3:a:apple:cups:1.1.8:*:*:*:*:*:*:*
    cpe:2.3:a:apple:cups:1.1.8:*:*:*:*:*:*:*
  • cpe:2.3:a:apple:cups:1.1.9:*:*:*:*:*:*:*
    cpe:2.3:a:apple:cups:1.1.9:*:*:*:*:*:*:*
  • cpe:2.3:a:apple:cups:1.1.9-1:*:*:*:*:*:*:*
    cpe:2.3:a:apple:cups:1.1.9-1:*:*:*:*:*:*:*
  • cpe:2.3:a:apple:cups:1.1.10:*:*:*:*:*:*:*
    cpe:2.3:a:apple:cups:1.1.10:*:*:*:*:*:*:*
  • cpe:2.3:a:apple:cups:1.1.10-1:*:*:*:*:*:*:*
    cpe:2.3:a:apple:cups:1.1.10-1:*:*:*:*:*:*:*
  • cpe:2.3:a:apple:cups:1.1.11:*:*:*:*:*:*:*
    cpe:2.3:a:apple:cups:1.1.11:*:*:*:*:*:*:*
  • cpe:2.3:a:apple:cups:1.1.12:*:*:*:*:*:*:*
    cpe:2.3:a:apple:cups:1.1.12:*:*:*:*:*:*:*
  • cpe:2.3:a:apple:cups:1.1.13:*:*:*:*:*:*:*
    cpe:2.3:a:apple:cups:1.1.13:*:*:*:*:*:*:*
  • cpe:2.3:a:apple:cups:1.1.14:*:*:*:*:*:*:*
    cpe:2.3:a:apple:cups:1.1.14:*:*:*:*:*:*:*
  • cpe:2.3:a:apple:cups:1.1.15:*:*:*:*:*:*:*
    cpe:2.3:a:apple:cups:1.1.15:*:*:*:*:*:*:*
  • cpe:2.3:a:apple:cups:1.1.16:*:*:*:*:*:*:*
    cpe:2.3:a:apple:cups:1.1.16:*:*:*:*:*:*:*
  • cpe:2.3:a:apple:cups:1.1.17:*:*:*:*:*:*:*
    cpe:2.3:a:apple:cups:1.1.17:*:*:*:*:*:*:*
  • cpe:2.3:a:apple:cups:1.1.18:*:*:*:*:*:*:*
    cpe:2.3:a:apple:cups:1.1.18:*:*:*:*:*:*:*
  • cpe:2.3:a:apple:cups:1.1.19:*:*:*:*:*:*:*
    cpe:2.3:a:apple:cups:1.1.19:*:*:*:*:*:*:*
  • cpe:2.3:a:apple:cups:1.1.19:rc1:*:*:*:*:*:*
    cpe:2.3:a:apple:cups:1.1.19:rc1:*:*:*:*:*:*
  • cpe:2.3:a:apple:cups:1.1.19:rc2:*:*:*:*:*:*
    cpe:2.3:a:apple:cups:1.1.19:rc2:*:*:*:*:*:*
  • cpe:2.3:a:apple:cups:1.1.19:rc3:*:*:*:*:*:*
    cpe:2.3:a:apple:cups:1.1.19:rc3:*:*:*:*:*:*
  • cpe:2.3:a:apple:cups:1.1.19:rc4:*:*:*:*:*:*
    cpe:2.3:a:apple:cups:1.1.19:rc4:*:*:*:*:*:*
  • cpe:2.3:a:apple:cups:1.1.19:rc5:*:*:*:*:*:*
    cpe:2.3:a:apple:cups:1.1.19:rc5:*:*:*:*:*:*
  • cpe:2.3:a:apple:cups:1.1.20:*:*:*:*:*:*:*
    cpe:2.3:a:apple:cups:1.1.20:*:*:*:*:*:*:*
  • cpe:2.3:a:apple:cups:1.1.20:rc1:*:*:*:*:*:*
    cpe:2.3:a:apple:cups:1.1.20:rc1:*:*:*:*:*:*
  • cpe:2.3:a:apple:cups:1.1.20:rc2:*:*:*:*:*:*
    cpe:2.3:a:apple:cups:1.1.20:rc2:*:*:*:*:*:*
  • cpe:2.3:a:apple:cups:1.1.20:rc3:*:*:*:*:*:*
    cpe:2.3:a:apple:cups:1.1.20:rc3:*:*:*:*:*:*
  • cpe:2.3:a:apple:cups:1.1.20:rc4:*:*:*:*:*:*
    cpe:2.3:a:apple:cups:1.1.20:rc4:*:*:*:*:*:*
  • cpe:2.3:a:apple:cups:1.1.20:rc5:*:*:*:*:*:*
    cpe:2.3:a:apple:cups:1.1.20:rc5:*:*:*:*:*:*
  • cpe:2.3:a:apple:cups:1.1.20:rc6:*:*:*:*:*:*
    cpe:2.3:a:apple:cups:1.1.20:rc6:*:*:*:*:*:*
  • cpe:2.3:a:apple:cups:1.1.21:*:*:*:*:*:*:*
    cpe:2.3:a:apple:cups:1.1.21:*:*:*:*:*:*:*
  • cpe:2.3:a:apple:cups:1.1.21:rc1:*:*:*:*:*:*
    cpe:2.3:a:apple:cups:1.1.21:rc1:*:*:*:*:*:*
  • cpe:2.3:a:apple:cups:1.1.21:rc2:*:*:*:*:*:*
    cpe:2.3:a:apple:cups:1.1.21:rc2:*:*:*:*:*:*
  • cpe:2.3:a:apple:cups:1.1.22:*:*:*:*:*:*:*
    cpe:2.3:a:apple:cups:1.1.22:*:*:*:*:*:*:*
  • cpe:2.3:a:apple:cups:1.1.22:rc1:*:*:*:*:*:*
    cpe:2.3:a:apple:cups:1.1.22:rc1:*:*:*:*:*:*
  • cpe:2.3:a:apple:cups:1.1.22:rc2:*:*:*:*:*:*
    cpe:2.3:a:apple:cups:1.1.22:rc2:*:*:*:*:*:*
  • cpe:2.3:a:apple:cups:1.1.23:*:*:*:*:*:*:*
    cpe:2.3:a:apple:cups:1.1.23:*:*:*:*:*:*:*
  • cpe:2.3:a:apple:cups:1.1.23:rc1:*:*:*:*:*:*
    cpe:2.3:a:apple:cups:1.1.23:rc1:*:*:*:*:*:*
  • cpe:2.3:a:apple:cups:1.2:b1:*:*:*:*:*:*
    cpe:2.3:a:apple:cups:1.2:b1:*:*:*:*:*:*
  • cpe:2.3:a:apple:cups:1.2:b2:*:*:*:*:*:*
    cpe:2.3:a:apple:cups:1.2:b2:*:*:*:*:*:*
  • cpe:2.3:a:apple:cups:1.2:rc1:*:*:*:*:*:*
    cpe:2.3:a:apple:cups:1.2:rc1:*:*:*:*:*:*
  • cpe:2.3:a:apple:cups:1.2:rc2:*:*:*:*:*:*
    cpe:2.3:a:apple:cups:1.2:rc2:*:*:*:*:*:*
  • cpe:2.3:a:apple:cups:1.2:rc3:*:*:*:*:*:*
    cpe:2.3:a:apple:cups:1.2:rc3:*:*:*:*:*:*
  • cpe:2.3:a:apple:cups:1.2.0:*:*:*:*:*:*:*
    cpe:2.3:a:apple:cups:1.2.0:*:*:*:*:*:*:*
  • cpe:2.3:a:apple:cups:1.2.1:*:*:*:*:*:*:*
    cpe:2.3:a:apple:cups:1.2.1:*:*:*:*:*:*:*
  • cpe:2.3:a:apple:cups:1.2.2:*:*:*:*:*:*:*
    cpe:2.3:a:apple:cups:1.2.2:*:*:*:*:*:*:*
  • cpe:2.3:a:apple:cups:1.2.3:*:*:*:*:*:*:*
    cpe:2.3:a:apple:cups:1.2.3:*:*:*:*:*:*:*
  • cpe:2.3:a:apple:cups:1.2.4:*:*:*:*:*:*:*
    cpe:2.3:a:apple:cups:1.2.4:*:*:*:*:*:*:*
  • cpe:2.3:a:apple:cups:1.2.5:*:*:*:*:*:*:*
    cpe:2.3:a:apple:cups:1.2.5:*:*:*:*:*:*:*
  • cpe:2.3:a:apple:cups:1.2.6:*:*:*:*:*:*:*
    cpe:2.3:a:apple:cups:1.2.6:*:*:*:*:*:*:*
  • cpe:2.3:a:apple:cups:1.2.7:*:*:*:*:*:*:*
    cpe:2.3:a:apple:cups:1.2.7:*:*:*:*:*:*:*
  • cpe:2.3:a:apple:cups:1.2.8:*:*:*:*:*:*:*
    cpe:2.3:a:apple:cups:1.2.8:*:*:*:*:*:*:*
  • cpe:2.3:a:apple:cups:1.2.9:*:*:*:*:*:*:*
    cpe:2.3:a:apple:cups:1.2.9:*:*:*:*:*:*:*
  • cpe:2.3:a:apple:cups:1.2.10:*:*:*:*:*:*:*
    cpe:2.3:a:apple:cups:1.2.10:*:*:*:*:*:*:*
  • cpe:2.3:a:apple:cups:1.2.11:*:*:*:*:*:*:*
    cpe:2.3:a:apple:cups:1.2.11:*:*:*:*:*:*:*
  • cpe:2.3:a:apple:cups:1.2.12:*:*:*:*:*:*:*
    cpe:2.3:a:apple:cups:1.2.12:*:*:*:*:*:*:*
  • cpe:2.3:a:apple:cups:1.3:b1:*:*:*:*:*:*
    cpe:2.3:a:apple:cups:1.3:b1:*:*:*:*:*:*
  • cpe:2.3:a:apple:cups:1.3:rc1:*:*:*:*:*:*
    cpe:2.3:a:apple:cups:1.3:rc1:*:*:*:*:*:*
  • cpe:2.3:a:apple:cups:1.3:rc2:*:*:*:*:*:*
    cpe:2.3:a:apple:cups:1.3:rc2:*:*:*:*:*:*
  • cpe:2.3:a:apple:cups:1.3.0:*:*:*:*:*:*:*
    cpe:2.3:a:apple:cups:1.3.0:*:*:*:*:*:*:*
  • cpe:2.3:a:apple:cups:1.3.1:*:*:*:*:*:*:*
    cpe:2.3:a:apple:cups:1.3.1:*:*:*:*:*:*:*
  • cpe:2.3:a:apple:cups:1.3.2:*:*:*:*:*:*:*
    cpe:2.3:a:apple:cups:1.3.2:*:*:*:*:*:*:*
  • cpe:2.3:a:apple:cups:1.3.3:*:*:*:*:*:*:*
    cpe:2.3:a:apple:cups:1.3.3:*:*:*:*:*:*:*
  • cpe:2.3:a:apple:cups:1.3.4:*:*:*:*:*:*:*
    cpe:2.3:a:apple:cups:1.3.4:*:*:*:*:*:*:*
  • cpe:2.3:a:apple:cups:1.3.5:*:*:*:*:*:*:*
    cpe:2.3:a:apple:cups:1.3.5:*:*:*:*:*:*:*
  • cpe:2.3:a:apple:cups:1.3.6:*:*:*:*:*:*:*
    cpe:2.3:a:apple:cups:1.3.6:*:*:*:*:*:*:*
  • cpe:2.3:a:apple:cups:-:*:*:*:*:*:*:*
    cpe:2.3:a:apple:cups:-:*:*:*:*:*:*:*
  • cpe:2.3:a:apple:cups:1.3.7:*:*:*:*:*:*:*
    cpe:2.3:a:apple:cups:1.3.7:*:*:*:*:*:*:*
CVSS
Base: 10.0 (as of 29-01-2009 - 06:58)
Impact:
Exploitability:
CWE CWE-255
CAPEC
Access
VectorComplexityAuthentication
NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
COMPLETE COMPLETE COMPLETE
cvss-vector via4 AV:N/AC:L/Au:N/C:C/I:C/A:C
refmap via4
confirm http://www.cups.org/str.php?L2774
mandriva MDVSA-2009:028
misc http://www.gnucitizen.org/blog/pwning-ubuntu-via-cups/
mlist [oss-security] 20081119 CVE request: CUPS DoS via RSS subscriptions
suse SUSE-SR:2008:026
statements via4
contributor Tomas Hoger
lastmodified 2008-12-03
organization Red Hat
statement Not vulnerable. This issue did not affect the versions of CUPS as shipped with Red Hat Enterprise Linux 3, 4, or 5. Versions shipped do not support RSS subscriptions.
Last major update 29-01-2009 - 06:58
Published 21-11-2008 - 02:30
Last modified 29-01-2009 - 06:58
Back to Top