Карточка уязвимости
Характеристики уязвимости
Уровень опасности
Оценка CVSS
(AV:N/AC:M/Au:N/C:N/I:N/A:P)
Производитель ПО
Наименование ПО
cups
(Unknown)
Описание
cupsd в CUPS позволяет локальным пользователям и, возможно, злоумышленникам, действующим удаленно, вызвать отказ в обслуживании (аварийное завершение работы демона), добавив большое количество подписок на RSS, что вызывает разыменование нулевого указателя.
Как исправить
Для устранения уязвимости необходимо установить последнюю версию продукта, соответствующую используемой платформе. Необходимую информацию можно получить по адресу:
http://www.cups.org/
http://www.cups.org/
Ссылки
CONFIRM (https://bugs.launchpad.net/ubuntu/+source/cups/+bug/298241): https://bugs.launchpad.net/ubuntu/+source/cups/+bug/298241
XF (cups-rss-dos(46684)): http://xforce.iss.net/xforce/xfdb/46684
SECTRACK (1021396): http://www.securitytracker.com/id?1021396
BID (32419): http://www.securityfocus.com/bid/32419
REDHAT (RHSA-2008:1029): http://www.redhat.com/support/errata/RHSA-2008-1029.html
MLIST ([oss-security] 20081120 Re: CVE request: CUPS DoS via RSS subscriptions): http://www.openwall.com/lists/oss-security/2008/11/20/1
MLIST ([oss-security] 20081119 Re: CVE request: CUPS DoS via RSS subscriptions): http://www.openwall.com/lists/oss-security/2008/11/19/4
MLIST ([oss-security] 20081119 CVE request: CUPS DoS via RSS subscriptions): http://www.openwall.com/lists/oss-security/2008/11/19/3
MILW0RM (7150): http://www.milw0rm.com/exploits/7150
MANDRIVA (MDVSA-2009:028): http://www.mandriva.com/security/advisories?name=MDVSA-2009:028
MISC (http://www.gnucitizen.org/blog/pwning-ubuntu-via-cups/): http://www.gnucitizen.org/blog/pwning-ubuntu-via-cups/
VUPEN (ADV-2009-0422): http://www.frsirt.com/english/advisories/2009/0422
CONFIRM (http://support.apple.com/kb/HT3438): http://support.apple.com/kb/HT3438
SUSE (SUSE-SR:2008:026): http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00002.html
APPLE (APPLE-SA-2009-02-12): http://lists.apple.com/archives/security-announce/2009/Feb/msg00000.html
MISC (http://lab.gnucitizen.org/projects/cups-0day): http://lab.gnucitizen.org/projects/cups-0day
XF (cups-rss-dos(46684)): http://xforce.iss.net/xforce/xfdb/46684
SECTRACK (1021396): http://www.securitytracker.com/id?1021396
BID (32419): http://www.securityfocus.com/bid/32419
REDHAT (RHSA-2008:1029): http://www.redhat.com/support/errata/RHSA-2008-1029.html
MLIST ([oss-security] 20081120 Re: CVE request: CUPS DoS via RSS subscriptions): http://www.openwall.com/lists/oss-security/2008/11/20/1
MLIST ([oss-security] 20081119 Re: CVE request: CUPS DoS via RSS subscriptions): http://www.openwall.com/lists/oss-security/2008/11/19/4
MLIST ([oss-security] 20081119 CVE request: CUPS DoS via RSS subscriptions): http://www.openwall.com/lists/oss-security/2008/11/19/3
MILW0RM (7150): http://www.milw0rm.com/exploits/7150
MANDRIVA (MDVSA-2009:028): http://www.mandriva.com/security/advisories?name=MDVSA-2009:028
MISC (http://www.gnucitizen.org/blog/pwning-ubuntu-via-cups/): http://www.gnucitizen.org/blog/pwning-ubuntu-via-cups/
VUPEN (ADV-2009-0422): http://www.frsirt.com/english/advisories/2009/0422
CONFIRM (http://support.apple.com/kb/HT3438): http://support.apple.com/kb/HT3438
SUSE (SUSE-SR:2008:026): http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00002.html
APPLE (APPLE-SA-2009-02-12): http://lists.apple.com/archives/security-announce/2009/Feb/msg00000.html
MISC (http://lab.gnucitizen.org/projects/cups-0day): http://lab.gnucitizen.org/projects/cups-0day
