PT-2023-3514 · Openprinting+9 · Cups+9
Azero13
·
Publicado
2023-06-22
·
Atualizado
2025-02-03
·
CVE-2023-34241
CVSS v3.1
7.1
Alta
| Vetor | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
OpenPrinting CUPS versions 2.0.0 through 2.4.6
Description
The issue is a use-after-free bug that impacts the entire cupsd process. It occurs when the function
httpClose(con->http) is called in scheduler/client.c, freeing the pointer at the end of the call, but cupsdLogClient passes the pointer to httpGetHostname. This happens in function cupsdAcceptClient if LogLevel is warn or higher, under two scenarios: a double-lookup for the IP Address fails to resolve, or if CUPS is compiled with TCP wrappers and the connection is refused by rules from /etc/hosts.allow and /etc/hosts.deny.Recommendations
To resolve the issue, update to version 2.4.6 or later, as it includes a patch for this problem.
As a temporary workaround, consider restricting the LogLevel to a setting lower than warn to minimize the risk of exploitation in versions prior to 2.4.6.
Restrict access to the
/etc/hosts.allow and /etc/hosts.deny files to prevent unauthorized modifications that could lead to exploitation in versions prior to 2.4.6.Exploit
Correção
DoS
Use After Free
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Almalinux
Astra Linux
Cups
Centos
Linuxmint
Apple Macos
Red Hat
Suse
Ubuntu