PT-2009-3224 · Apple · Cups

Keishi.Sonoda · Published 2009-02-20 · Updated 2023-02-13 · CVE-2009-0577

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions CUPS version 1.1.17

Description The issue is caused by an integer overflow in the WriteProlog function in texttops, which can be exploited by remote attackers to execute arbitrary code. This is achieved by sending a crafted PostScript file that triggers a heap-based buffer overflow.

Recommendations For CUPS version 1.1.17, consider applying a patch or fix to address the integer overflow issue in the WriteProlog function. As a temporary workaround, restrict access to the texttops functionality to minimize the risk of exploitation.

Fix

RCE

Weakness Enumeration

CWE-189

Related Identifiers

CVE-2009-0577

RHSA-2009:0308

Affected Products

Cups

References · 8

• http://redhat.com/support/errata/RHSA-2009-0308.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-0577 · Security Note
• http://support.avaya.com/elmodocs2/security/ASA-2009-064.htm · Note
• http://secunia.com/advisories/33995 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=486052 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/48977 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9968 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0577 · Note