PT-2015-2909 · Openprinting+5 · Cups-Filters+6
Michal Kowalczyk
·
Publicado
2015-12-02
·
Atualizado
2024-06-15
·
CVE-2015-8327
CVSS v2.0
7.5
Alta
| Vetor | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
cups-filters versions 1.0.42 through 1.2.0
Foomatic versions 4.0.x
Description
The issue is related to an incomplete blacklist vulnerability in the util.c component of foomatic-rip, which is part of the cups-filters package and the Foomatic operating system. This vulnerability can be exploited by a remote attacker to execute arbitrary commands by using ` (backtick) characters in a print job.
Recommendations
For cups-filters versions 1.0.42 through 1.2.0, update to version 1.2.0 or later to resolve the issue.
For Foomatic versions 4.0.x, consider disabling the foomatic-rip component until a patch is available.
As a temporary workaround, restrict the use of the ` (backtick) character in print jobs to minimize the risk of exploitation.
Correção
Incomplete List of Disallowed Inputs
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Centos
Foomatic
Red Hat
Suse
Ubuntu
Cups-Filters