Vulnerability CVE-2017-18190


Published: 2018-02-16

Description:
A localhost.localdomain whitelist entry in valid_host() in scheduler/client.c in CUPS before 2.2.2 allows remote attackers to execute arbitrary IPP commands by sending POST requests to the CUPS daemon in conjunction with DNS rebinding. The localhost.localdomain name is often resolved via a DNS server (neither the OS nor the web browser is responsible for ensuring that localhost.localdomain is 127.0.0.1).

Type:

CWE-254

(Security Features)

Vendor: Debian
Product: Debian linux 
Version: 7.0;
Vendor: Apple
Product: CUPS 
Version:
2.1
2.0.1
2.0
1.7.4
1.7.3
1.7.2
1.7.1
1.7.0
1.7
1.6.4
1.6.3
1.6.2
1.6.1
1.6
1.5.4
1.5.3
1.5.2
1.5.1
1.5.0
1.5
1.4.8
1.4.7
1.4.6
1.4.5
1.4.4
1.4.3
1.4.2
1.4.1
1.4.0
1.4
1.3.9
1.3.8
1.3.7
1.3.6
1.3.5
1.3.4
1.3.3
1.3.2
1.3.11
1.3.10
1.3.1
1.3.0
1.3
1.2.9
1.2.8
1.2.7
1.2.6
1.2.5
1.2.4
1.2.3
1.2.2
1.2.12
1.2.11
1.2.10
1.2.1
1.2.0
1.2
1.1.9-1
1.1.9
1.1.8
1.1.7
1.1.6-3
1.1.6-2
1.1.6-1
1.1.6
1.1.5-2
1.1.5-1
1.1.5
1.1.4
1.1.3
1.1.23
1.1.22
1.1.21
1.1.20
1.1.2
1.1.19
1.1.18
1.1.17
1.1.16
1.1.15
1.1.14
1.1.13
1.1.12
1.1.11
1.1.10-1
1.1.10
1.1.1
1.1

CVSS2 => (AV:N/AC:L/Au:N/C:N/I:P/A:N)

CVSS Base Score
Impact Subscore
Exploitability Subscore
5/10
2.9/10
10/10
Exploit range
Attack complexity
Authentication
Remote
Low
No required
Confidentiality impact
Integrity impact
Availability impact
None
Partial
None

 References:
https://bugs.chromium.org/p/project-zero/issues/detail?id=1048
https://github.com/apple/cups/commit/afa80cb2b457bf8d64f775bed307588610476c41
https://lists.debian.org/debian-lts-announce/2018/02/msg00023.html
https://usn.ubuntu.com/3577-1/

Related CVE
CVE-2017-18248
The add_job function in scheduler/ipp.c in CUPS before 2.2.6, when D-Bus support is enabled, can be crashed by remote attackers by sending print jobs with an invalid username, related to a D-Bus notification.
CVE-2014-8130
The _TIFFmalloc function in tif_unix.c in LibTIFF 4.0.3 does not reject a zero size, which allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted TIFF image that is mishandled by the TIFFWriteS...
CVE-2014-8129
LibTIFF 4.0.3 allows remote attackers to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact via a crafted TIFF image, as demonstrated by failure of tif_next.c to verify that the BitsPerSample value is 2, and the...
CVE-2017-7163
An issue was discovered in certain Apple products. macOS before 10.13.2 is affected. The issue involves the "Intel Graphics Driver" component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory ...
CVE-2017-7162
An issue was discovered in certain Apple products. iOS before 11.2 is affected. macOS before 10.13.2 is affected. tvOS before 11.2 is affected. watchOS before 4.2 is affected. The issue involves the "IOKit" component. It allows attackers to execute a...
CVE-2017-7160
An issue was discovered in certain Apple products. iOS before 11.2 is affected. Safari before 11.0.2 is affected. iCloud before 7.2 on Windows is affected. iTunes before 12.7.2 on Windows is affected. tvOS before 11.2 is affected. The issue involves ...
CVE-2017-7159
An issue was discovered in certain Apple products. macOS before 10.13.2 is affected. The issue involves the "IOAcceleratorFamily" component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory co...
CVE-2017-7158
An issue was discovered in certain Apple products. macOS before 10.13.2 is affected. The issue involves the "Screen Sharing Server" component. It allows attackers to obtain root privileges for reading files by leveraging screen-sharing access.

Copyright 2018, cxsecurity.com

 

Back to Top