PT-2008-1101 · Apple · Cups

Iankko + 1 · Published 2008-12-01 · Updated 2017-09-29 · CVE-2008-5286

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions CUPS versions 1.1.17 through 1.3.9

Description The issue concerns multiple vulnerabilities in the CUPS package that can be exploited remotely, potentially leading to breaches in confidentiality, integrity, and availability of protected information. Specifically, an integer overflow in the cupsImageReadPNG function allows remote attackers to execute arbitrary code via a PNG image with a large height value, bypassing validation checks and triggering a buffer overflow.

Recommendations For CUPS versions 1.1.17 through 1.3.9, update to a version newer than 1.3.9 to resolve the issue. As a temporary workaround, consider restricting the use of PNG images or disabling the cupsImageReadPNG function until a patch is available. Avoid using the height variable in the affected CUPS function to minimize the risk of exploitation.

Fix

RCE

Buffer Overflow

Weakness Enumeration

CWE-119

CWE-189

Related Identifiers

BDU:2015-09353

CVE-2008-5286

DSA-1677-1

RHSA-2008:1028

Affected Products

Cups

References · 26

• http://debian.org/security/2008/dsa-1677 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2009:029 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2008-5286 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-5286 · Security Note
• http://securityfocus.com/bid/32518 · Patch
• http://lists.opensuse.org/opensuse-security-announce/2009-01/msg00004.html · Vendor Advisory
• http://gentoo.org/security/en/glsa/glsa-200812-11.xml · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2008-5286 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2008-1028.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-09353 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2008-5286 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2009:028 · Vendor Advisory
• http://gentoo.org/security/en/glsa/glsa-200812-01.xml · Vendor Advisory
• http://cups.org/str.php?L2974 · Vendor Advisory
• http://openwall.com/lists/oss-security/2008/12/01/1 · Note