PT-2007-1110 · Apple · Cups

Elias Pipping · Published 2007-12-18 · Updated 2017-07-29 · CVE-2007-5849

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: CUPS versions 1.2 through 1.3.4 cups prior to version 1.3.5

Description: The issue is related to an integer underflow in the asn1 get string function in the SNMP back end, which can be exploited by remote attackers to execute arbitrary code via a crafted SNMP response, triggering a stack-based buffer overflow. Multiple vulnerabilities in the cups package can lead to breaches of confidentiality, integrity, and availability of protected information, and can be exploited remotely.

Recommendations: For CUPS versions 1.2 through 1.3.4, update to version 1.3.5 or later to resolve the issue. For cups prior to version 1.3.5, update to version 1.3.5 or later to resolve the issue.

Exploit

Fix

RCE

Weakness Enumeration

CWE-189

Related Identifiers

BDU:2015-09592

CVE-2007-5849

DSA-1437-1

Affected Products

Cups

References · 34

• 🔥 https://exploit-db.com/exploits/30898 · Exploit
• http://secunia.com/advisories/28441 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-09592 · Security Note
• http://secunia.com/advisories/28636 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2008-01/msg00003.html · Vendor Advisory
• https://redhat.com/archives/fedora-package-announce/2008-January/msg00908.html · Vendor Advisory
• http://debian.org/security/2007/dsa-1437 · Vendor Advisory
• http://secunia.com/advisories/28136 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-5849 · Security Note
• http://lists.apple.com/archives/security-announce/2007/Dec/msg00002.html · Vendor Advisory
• http://gentoo.org/security/en/glsa/glsa-200712-14.xml · Vendor Advisory
• http://secunia.com/advisories/28676 · Vendor Advisory
• http://ubuntu.com/usn/usn-563-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2007-5849 · Vendor Advisory
• http://vupen.com/english/advisories/2007/4242 · Vendor Advisory