PT-2023-3514 · Openprinting+9 · Cups+9

Azero13

·

Publicado

2023-06-22

·

Atualizado

2025-02-03

·

CVE-2023-34241

CVSS v3.1

7.1

Alta

VetorAV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Name of the Vulnerable Software and Affected Versions OpenPrinting CUPS versions 2.0.0 through 2.4.6
Description The issue is a use-after-free bug that impacts the entire cupsd process. It occurs when the function httpClose(con->http) is called in scheduler/client.c, freeing the pointer at the end of the call, but cupsdLogClient passes the pointer to httpGetHostname. This happens in function cupsdAcceptClient if LogLevel is warn or higher, under two scenarios: a double-lookup for the IP Address fails to resolve, or if CUPS is compiled with TCP wrappers and the connection is refused by rules from /etc/hosts.allow and /etc/hosts.deny.
Recommendations To resolve the issue, update to version 2.4.6 or later, as it includes a patch for this problem. As a temporary workaround, consider restricting the LogLevel to a setting lower than warn to minimize the risk of exploitation in versions prior to 2.4.6. Restrict access to the /etc/hosts.allow and /etc/hosts.deny files to prevent unauthorized modifications that could lead to exploitation in versions prior to 2.4.6.

Exploit

Correção

DoS

Use After Free

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾

Enumeração de Fraquezas

Identificadores relacionados

ALSA-2023:6596
ALSA-2023:7165
ALT-PU-2023-5990
ALT-PU-2023-6178
ALT-PU-2023-6721
ALT-PU-2024-4621
AZL-37074
AZL-37099
BDU:2023-03719
CESA-2023_7165
CVE-2023-34241
DLA-3476-1
GHSA-QJGH-5HCQ-5F25
MGASA-2023-0223
OESA-2023-1410
OPENSUSE-SU-2024:13017-1
RHSA-2023:6596
RHSA-2023:7165
RHSA-2023_6596
RHSA-2023_7165
RHSA-2024:1101
RHSA-2024:1409
ROSA-SA-2024-2377
SUSE-SU-2023:2616-1
SUSE-SU-2023:3706-1
SUSE-SU-2023_2616-1
SUSE-SU-2025:20090-1
USN-6184-1
USN-6184-2

Produtos afetados

Alt Linux
Almalinux
Astra Linux
Cups
Centos
Linuxmint
Apple Macos
Red Hat
Suse
Ubuntu