CVE-2009-3553 - Use-after-free vulnerability in the abstract file-descriptor handling interface in the cupsdDoSelect

CVE-2009-3553

Summary

Use-after-free vulnerability in the abstract file-descriptor handling interface in the cupsdDoSelect function in scheduler/select.c in the scheduler in cupsd in CUPS 1.3.7 and 1.3.10 allows remote attackers to cause a denial of service (daemon crash or hang) via a client disconnection during listing of a large number of print jobs, related to improperly maintaining a reference count. NOTE: some of these details are obtained from third party information.

References

Vulnerable Configurations

cpe:2.3:a:apple:cups:1.3.7:*:*:*:*:*:*:*
cpe:2.3:a:apple:cups:1.3.7:*:*:*:*:*:*:*
cpe:2.3:a:apple:cups:1.3.10:*:*:*:*:*:*:*
cpe:2.3:a:apple:cups:1.3.10:*:*:*:*:*:*:*

CVSS

Base:	5.0 (as of 19-09-2017 - 01:29)
Impact:
Exploitability:

CWE

CWE-399

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	LOW	NONE

Impact

Confidentiality	Integrity	Availability
NONE	NONE	PARTIAL

cvss-vector via4

AV:N/AC:L/Au:N/C:N/I:N/A:P

oval via4

accepted

2013-04-29T04:12:08.204-04:00

class

vulnerability

contributors

name Aharon Chernin
organization SCAP.com, LLC
name Dragos Prisaca
organization G2, Inc.

definition_extensions

comment The operating system installed on the system is Red Hat Enterprise Linux 5
oval oval:org.mitre.oval:def:11414
comment The operating system installed on the system is CentOS Linux 5.x
oval oval:org.mitre.oval:def:15802
comment Oracle Linux 5.x
oval oval:org.mitre.oval:def:15459

description

family

unix

oval:org.mitre.oval:def:11183

status

accepted

submitted

2010-07-09T03:56:16-04:00

title

version

redhat via4

advisories

bugzilla

id	530111
title	CVE-2009-3553 cups: Use-after-free (crash) due improper reference counting in abstract file descriptors handling interface

oval

comment Red Hat Enterprise Linux must be installed
oval oval:com.redhat.rhba:tst:20070304026

AND

comment Red Hat Enterprise Linux 5 is installed
oval oval:com.redhat.rhba:tst:20070331005

AND
comment cups is earlier than 1:1.3.7-11.el5_4.4
oval oval:com.redhat.rhsa:tst:20091595001
comment cups is signed with Red Hat redhatrelease key
oval oval:com.redhat.rhsa:tst:20070123009
AND
comment cups-devel is earlier than 1:1.3.7-11.el5_4.4
oval oval:com.redhat.rhsa:tst:20091595003
comment cups-devel is signed with Red Hat redhatrelease key
oval oval:com.redhat.rhsa:tst:20070123011
AND
comment cups-libs is earlier than 1:1.3.7-11.el5_4.4
oval oval:com.redhat.rhsa:tst:20091595005
comment cups-libs is signed with Red Hat redhatrelease key
oval oval:com.redhat.rhsa:tst:20070123013
AND
comment cups-lpd is earlier than 1:1.3.7-11.el5_4.4
oval oval:com.redhat.rhsa:tst:20091595007
comment cups-lpd is signed with Red Hat redhatrelease key
oval oval:com.redhat.rhsa:tst:20070123015

rhsa

id	RHSA-2009:1595
released	2009-11-18
severity	Moderate
title	RHSA-2009:1595: cups security update (Moderate)

rpms

cups-1:1.3.7-11.el5_4.4
cups-debuginfo-1:1.3.7-11.el5_4.4
cups-devel-1:1.3.7-11.el5_4.4
cups-libs-1:1.3.7-11.el5_4.4
cups-lpd-1:1.3.7-11.el5_4.4

refmap via4

apple	APPLE-SA-2010-01-19-1
bid	37048
confirm	http://support.apple.com/kb/HT4004 https://bugzilla.redhat.com/show_bug.cgi?id=530111
debian	DSA-2176
fedora	FEDORA-2009-12652
gentoo	GLSA-201207-10
mandriva	MDVSA-2010:073
misc	http://www.cups.org/newsgroups.php/newsgroups.php?v5994+gcups.bugs http://www.cups.org/newsgroups.php/newsgroups.php?v5996+gcups.bugs http://www.cups.org/newsgroups.php/newsgroups.php?v6055+gcups.bugs http://www.cups.org/str.php?L3200
secunia	37360 37364 38241 43521
sunalert	275230
ubuntu	USN-906-1
vupen	ADV-2010-0173 ADV-2011-0535

Last major update

19-09-2017 - 01:29

Published

20-11-2009 - 02:30

Last modified

19-09-2017 - 01:29