PT-2004-3049 · Apple+1 · Cups+1

Publicado 2004-12-31 · Atualizado 2024-08-01 · CVE-2004-2154

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions CUPS versions prior to 1.1.21rc1

Description The issue allows attackers to bypass intended Access Control Lists (ACLs) due to the case-sensitive treatment of a Location directive in cupsd.conf. This can be exploited via a printer name containing uppercase or lowercase letters that differ from what is specified in the directive.

Recommendations For versions prior to 1.1.21rc1, update to version 1.1.21rc1 or later to resolve the issue. As a temporary workaround, consider ensuring that all printer names and Location directives in cupsd.conf are specified with consistent case to minimize the risk of exploitation.

Correção

Enumeração de Fraquezas

CWE-178

Identificadores relacionados

CVE-2004-2154

RHSA-2005:571

RHSA-2005_571

Produtos afetados

Cups

Red Hat

Referências · 16

• https://osv.dev/vulnerability/DEBIAN-CVE-2004-2154 · Aviso do Fabricante
• https://redhat.com/security/data/cve/CVE-2004-2154.html · Nota
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9940 · Nota
• https://security-tracker.debian.org/tracker/CVE-2004-2154 · Aviso do Fabricante
• http://cups.org/str.php?L700 · Correção
• https://t.me/cvenotify/71674 · Publicação no Telegram
• http://ubuntu.com/usn/usn-185-1 · Aviso do Fabricante
• https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=163274 · Aviso do Fabricante
• https://t.me/cvenotify/88212 · Publicação no Telegram
• https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=162405 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-2154 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2004-2154 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2004-2154 · Aviso do Fabricante
• https://rhn.redhat.com/errata/RHSA-2005-571.html · Nota
• http://novell.com/linux/security/advisories/2005_18_sr.html · Aviso do Fabricante