PT-2014-5819 · Cups+1 · Cups-Filters+1

Published 2014-05-08 · Updated 2024-06-15 · CVE-2014-4336

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:A/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions cups-filters versions prior to 1.0.53

Description The issue allows remote IPP printers to execute arbitrary commands via shell metacharacters in the host name, due to an incomplete fix for a previous security issue. This is related to the generate local queue function in utils/cups-browsed.c.

Recommendations For versions prior to 1.0.53, update to version 1.0.53 or later to resolve the issue. As a temporary workaround, consider restricting access to the generate local queue function in utils/cups-browsed.c to minimize the risk of exploitation.

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

ALT-PU-2014-1665

CVE-2014-4336

MGASA-2014-0267

OPENSUSE-SU-2024:10313-1

USN-2210-1

Affected Products

Alt Linux

Cups-Filters

References · 47

• https://ubuntu.com/security/CVE-2014-2707 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-2210-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-06084 · Security Note
• http://openwall.com/lists/oss-security/2014/04/25/7 · Patch
• https://bdu.fstec.ru/vul/2015-09199 · Security Note
• https://osv.dev/vulnerability/USN-2210-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2014-4336 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2707 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2014-4336 · Security Note
• https://bdu.fstec.ru/vul/2015-09753 · Security Note
• https://cve.org/CVERecord?id=CVE-2014-4336 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4338 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4337 · Security Note
• https://ubuntu.com/security/CVE-2014-4336 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2014-4336 · Vendor Advisory