PT-2018-1823 · Apple+5 · Cups+5

Jann Horn · Published 2017-02-27 · Updated 2020-10-20 · CVE-2017-18190

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions: CUPS versions prior to 2.2.2

Description: The issue allows remote attackers to execute arbitrary IPP commands by sending POST requests to the CUPS daemon in conjunction with DNS rebinding, potentially disrupting data integrity. This is due to a localhost.localdomain whitelist entry in the valid host() function in scheduler/client.c. The localhost.localdomain name is often resolved via a DNS server.

Recommendations: For versions prior to 2.2.2, update to version 2.2.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the CUPS daemon to minimize the risk of exploitation. Avoid using the valid host() function in conjunction with DNS rebinding until the issue is resolved.

Exploit

Fix

RCE

Authentication Bypass by Spoofing

Weakness Enumeration

CWE-254

CWE-290

Related Identifiers

ALT-PU-2017-1217

BDU:2018-01423

CESA-2020_3864

CVE-2017-18190

DLA-1288-1

DLA-1412-1

MGASA-2018-0147

OPENSUSE-SU-2018_0618-1

RHSA-2020:3864

RHSA-2020_3864

SUSE-SU-2018:0604-1

SUSE-SU-2018_0604-1

USN-3577-1

Affected Products

Alt Linux

Cups

Centos

Red Hat

Suse

Ubuntu

References · 28

• 🔥 https://bugs.chromium.org/p/project-zero/issues/detail?id=1048 · Exploit
• https://github.com/apple/cups/commit/afa80cb2b457bf8d64f775bed307588610476c41 · Patch
• https://osv.dev/vulnerability/CVE-2017-18190 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2020-3864.html · Vendor Advisory
• https://ubuntu.com/security/notices/USN-3577-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-18190 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2017-18190; · Security Note
• https://osv.dev/vulnerability/DLA-1412-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2018:0604-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-18190 · Vendor Advisory
• https://osv.dev/vulnerability/USN-3577-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-18190 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-18190 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2018-0147.html · Security Note
• https://bdu.fstec.ru/vul/2018-01423 · Security Note