PT-2002-3147 · Apple · Cups-Devel+3

Published 1970-01-01 · Updated 2017-10-10 · CVE-2002-1369

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions CUPS versions 1.1.14 through 1.1.17 libcupsys1 versions (affected versions not specified) cups-libs versions (affected versions not specified) cups-devel versions (affected versions not specified)

Description The issue concerns multiple vulnerabilities in the CUPS package, which can lead to a breach of confidentiality, integrity, and availability of protected information. These vulnerabilities can be exploited remotely. The problem is caused by the improper use of the strncat function call when processing the options string in jobs.c, allowing remote attackers to execute arbitrary code via a buffer overflow attack.

Recommendations For CUPS versions 1.1.14 through 1.1.17, update to a version outside of this range to resolve the issue. For libcupsys1, cups-libs, and cups-devel, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

BDU:2015-01804

BDU:2015-01805

BDU:2015-07982

BDU:2015-07983

BDU:2015-07984

BDU:2015-07985

BDU:2015-07986

BDU:2015-07987

CVE-2002-1369

DSA-232

Affected Products

Cups

Cups-Devel

Cups-Libs

Libcupsys1

References · 34

• 🔥 http://idefense.com/advisory/12.19.02.txt · Exploit
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1384 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2002-1369 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-07984 · Security Note
• http://redhat.com/support/errata/RHSA-2002-295.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2002-1369 · Security Note
• http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000702 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1368 · Security Note
• https://bdu.fstec.ru/vul/2015-07986 · Security Note
• http://debian.org/security/2003/dsa-232 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-07985 · Security Note
• https://bdu.fstec.ru/vul/2015-07983 · Security Note
• https://bdu.fstec.ru/vul/2015-01805 · Security Note
• http://novell.com/linux/security/advisories/2003_002_cups.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1383 · Security Note