Executive Summary
| Summary | |
|---|---|
| Title | cups security update |
| Informations | |||
|---|---|---|---|
| Name | RHSA-2008:1029 | First vendor Publication | 2008-12-15 |
| Vendor | RedHat | Last vendor Modification | 2008-12-15 |
| Severity (Vendor) | Moderate | Revision | 01 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:M/Au:N/C:N/I:N/A:P) | |||
|---|---|---|---|
| Cvss Base Score | 4.3 | Attack Range | Network |
| Cvss Impact Score | 2.9 | Attack Complexity | Medium |
| Cvss Expoit Score | 8.6 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| Problem Description: Updated cups packages that fix a security issue are now available for Red Hat Enterprise Linux 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. 2. Relevant releases/architectures: Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64 RHEL Desktop Workstation (v. 5 client) - i386, x86_64 Red Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, s390x, x86_64 3. Description: The Common UNIX® Printing System (CUPS) provides a portable printing layer for UNIX operating systems. A null pointer dereference flaw was found in the way CUPS handled subscriptions for printing job completion notifications. A local user could use this flaw to crash the CUPS daemon by submitting a large number of printing jobs requiring mail notification on completion, leading to a denial of service. (CVE-2008-5183) Users of cups should upgrade to these updated packages, which contain a backported patch to correct this issue. 4. Solution: Before applying this update, make sure that all previously-released errata relevant to your system have been applied. This update is available via Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at http://kbase.redhat.com/faq/docs/DOC-11259 5. Package List: Red Hat Enterprise Linux Desktop (v. 5 client): Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/cups-1.2.4-11.18.el5_2.3.src.rpm i386: cups-1.2.4-11.18.el5_2.3.i386.rpm cups-debuginfo-1.2.4-11.18.el5_2.3.i386.rpm cups-libs-1.2.4-11.18.el5_2.3.i386.rpm cups-lpd-1.2.4-11.18.el5_2.3.i386.rpm x86_64: cups-1.2.4-11.18.el5_2.3.x86_64.rpm cups-debuginfo-1.2.4-11.18.el5_2.3.i386.rpm cups-debuginfo-1.2.4-11.18.el5_2.3.x86_64.rpm cups-libs-1.2.4-11.18.el5_2.3.i386.rpm cups-libs-1.2.4-11.18.el5_2.3.x86_64.rpm cups-lpd-1.2.4-11.18.el5_2.3.x86_64.rpm RHEL Desktop Workstation (v. 5 client): Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/cups-1.2.4-11.18.el5_2.3.src.rpm i386: cups-debuginfo-1.2.4-11.18.el5_2.3.i386.rpm cups-devel-1.2.4-11.18.el5_2.3.i386.rpm x86_64: cups-debuginfo-1.2.4-11.18.el5_2.3.i386.rpm cups-debuginfo-1.2.4-11.18.el5_2.3.x86_64.rpm cups-devel-1.2.4-11.18.el5_2.3.i386.rpm cups-devel-1.2.4-11.18.el5_2.3.x86_64.rpm Red Hat Enterprise Linux (v. 5 server): Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/os/SRPMS/cups-1.2.4-11.18.el5_2.3.src.rpm i386: cups-1.2.4-11.18.el5_2.3.i386.rpm cups-debuginfo-1.2.4-11.18.el5_2.3.i386.rpm cups-devel-1.2.4-11.18.el5_2.3.i386.rpm cups-libs-1.2.4-11.18.el5_2.3.i386.rpm cups-lpd-1.2.4-11.18.el5_2.3.i386.rpm ia64: cups-1.2.4-11.18.el5_2.3.ia64.rpm cups-debuginfo-1.2.4-11.18.el5_2.3.i386.rpm cups-debuginfo-1.2.4-11.18.el5_2.3.ia64.rpm cups-devel-1.2.4-11.18.el5_2.3.ia64.rpm cups-libs-1.2.4-11.18.el5_2.3.i386.rpm cups-libs-1.2.4-11.18.el5_2.3.ia64.rpm cups-lpd-1.2.4-11.18.el5_2.3.ia64.rpm ppc: cups-1.2.4-11.18.el5_2.3.ppc.rpm cups-debuginfo-1.2.4-11.18.el5_2.3.ppc.rpm cups-debuginfo-1.2.4-11.18.el5_2.3.ppc64.rpm cups-devel-1.2.4-11.18.el5_2.3.ppc.rpm cups-devel-1.2.4-11.18.el5_2.3.ppc64.rpm cups-libs-1.2.4-11.18.el5_2.3.ppc.rpm cups-libs-1.2.4-11.18.el5_2.3.ppc64.rpm cups-lpd-1.2.4-11.18.el5_2.3.ppc.rpm s390x: cups-1.2.4-11.18.el5_2.3.s390x.rpm cups-debuginfo-1.2.4-11.18.el5_2.3.s390.rpm cups-debuginfo-1.2.4-11.18.el5_2.3.s390x.rpm cups-devel-1.2.4-11.18.el5_2.3.s390.rpm cups-devel-1.2.4-11.18.el5_2.3.s390x.rpm cups-libs-1.2.4-11.18.el5_2.3.s390.rpm cups-libs-1.2.4-11.18.el5_2.3.s390x.rpm cups-lpd-1.2.4-11.18.el5_2.3.s390x.rpm x86_64: cups-1.2.4-11.18.el5_2.3.x86_64.rpm cups-debuginfo-1.2.4-11.18.el5_2.3.i386.rpm cups-debuginfo-1.2.4-11.18.el5_2.3.x86_64.rpm cups-devel-1.2.4-11.18.el5_2.3.i386.rpm cups-devel-1.2.4-11.18.el5_2.3.x86_64.rpm cups-libs-1.2.4-11.18.el5_2.3.i386.rpm cups-libs-1.2.4-11.18.el5_2.3.x86_64.rpm cups-lpd-1.2.4-11.18.el5_2.3.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://www.redhat.com/security/team/key/#package |
Original Source
| Url : https://rhn.redhat.com/errata/RHSA-2008-1029.html |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 100 % | CWE-476 | NULL Pointer Dereference |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:10586 | |||
| Oval ID: | oval:org.mitre.oval:def:10586 | ||
| Title: | cupsd in CUPS 1.3.9 and earlier allows local users, and possibly remote attackers, to cause a denial of service (daemon crash) by adding a large number of RSS Subscriptions, which triggers a NULL pointer dereference. NOTE: this issue can be triggered remotely by leveraging CVE-2008-5184. | ||
| Description: | cupsd in CUPS 1.3.9 and earlier allows local users, and possibly remote attackers, to cause a denial of service (daemon crash) by adding a large number of RSS Subscriptions, which triggers a NULL pointer dereference. NOTE: this issue can be triggered remotely by leveraging CVE-2008-5184. | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2008-5183 | Version: | 5 |
| Platform(s): | Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5 | Product(s): | |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:22728 | |||
| Oval ID: | oval:org.mitre.oval:def:22728 | ||
| Title: | ELSA-2008:1029: cups security update (Moderate) | ||
| Description: | cupsd in CUPS 1.3.9 and earlier allows local users, and possibly remote attackers, to cause a denial of service (daemon crash) by adding a large number of RSS Subscriptions, which triggers a NULL pointer dereference. NOTE: this issue can be triggered remotely by leveraging CVE-2008-5184. | ||
| Family: | unix | Class: | patch |
| Reference(s): | ELSA-2008:1029-01 CVE-2008-5183 | Version: | 6 |
| Platform(s): | Oracle Linux 5 | Product(s): | cups |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:29137 | |||
| Oval ID: | oval:org.mitre.oval:def:29137 | ||
| Title: | RHSA-2008:1029 -- cups security update (Moderate) | ||
| Description: | Updated cups packages that fix a security issue are now available for Red Hat Enterprise Linux 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. | ||
| Family: | unix | Class: | patch |
| Reference(s): | RHSA-2008:1029 CESA-2008:1029-CentOS 5 CVE-2008-5183 | Version: | 3 |
| Platform(s): | Red Hat Enterprise Linux 5 CentOS Linux 5 | Product(s): | cups |
| Definition Synopsis: | |||
| |||
CPE : Common Platform Enumeration
OpenVAS Exploits
| Date | Description |
|---|---|
| 2011-03-09 | Name : Debian Security Advisory DSA 2176-1 (cups) File : nvt/deb_2176_1.nasl |
| 2010-05-12 | Name : Mac OS X Security Update 2009-001 File : nvt/macosx_secupd_2009-001.nasl |
| 2009-12-10 | Name : Fedora Core 10 FEDORA-2009-11062 (cups) File : nvt/fcore_2009_11062.nasl |
| 2009-12-10 | Name : Fedora Core 10 FEDORA-2009-12652 (cups) File : nvt/fcore_2009_12652.nasl |
| 2009-11-17 | Name : Mac OS X Version File : nvt/macosx_version.nasl |
| 2009-06-05 | Name : Ubuntu USN-707-1 (cupsys) File : nvt/ubuntu_707_1.nasl |
| 2009-04-28 | Name : Fedora Core 9 FEDORA-2009-3753 (cups) File : nvt/fcore_2009_3753.nasl |
| 2009-04-28 | Name : Fedora Core 10 FEDORA-2009-3769 (cups) File : nvt/fcore_2009_3769.nasl |
| 2009-03-06 | Name : RedHat Update for cups RHSA-2008:1029-01 File : nvt/gb_RHSA-2008_1029-01_cups.nasl |
| 2009-02-16 | Name : Fedora Update for cups FEDORA-2008-10895 File : nvt/gb_fedora_2008_10895_cups_fc10.nasl |
| 2009-02-16 | Name : Fedora Update for cups FEDORA-2008-10911 File : nvt/gb_fedora_2008_10911_cups_fc8.nasl |
| 2009-02-16 | Name : Fedora Update for cups FEDORA-2008-10917 File : nvt/gb_fedora_2008_10917_cups_fc9.nasl |
| 2008-11-26 | Name : CUPS Subscription Incorrectly uses Guest Account DoS Vulnerability File : nvt/gb_cups_guest_acc_dos_vuln.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 50351 | CUPS cupsd RSS Subscription Saturation NULL Dereference DoS |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2013-07-12 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2008-1029.nasl - Type : ACT_GATHER_INFO |
| 2012-08-01 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20081215_cups_on_SL3_x.nasl - Type : ACT_GATHER_INFO |
| 2011-03-02 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-2176.nasl - Type : ACT_GATHER_INFO |
| 2010-01-06 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2008-1029.nasl - Type : ACT_GATHER_INFO |
| 2009-07-21 | Name : The remote openSUSE host is missing a security update. File : suse_11_0_cups-081121.nasl - Type : ACT_GATHER_INFO |
| 2009-04-23 | Name : The remote Fedora host is missing a security update. File : fedora_2008-10895.nasl - Type : ACT_GATHER_INFO |
| 2009-04-23 | Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2009-028.nasl - Type : ACT_GATHER_INFO |
| 2009-04-23 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-707-1.nasl - Type : ACT_GATHER_INFO |
| 2009-02-13 | Name : The remote host is missing a Mac OS X update that fixes various security issues. File : macosx_SecUpd2009-001.nasl - Type : ACT_GATHER_INFO |
| 2008-12-16 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2008-1029.nasl - Type : ACT_GATHER_INFO |
| 2008-12-10 | Name : The remote Fedora host is missing a security update. File : fedora_2008-10911.nasl - Type : ACT_GATHER_INFO |
| 2008-12-10 | Name : The remote Fedora host is missing a security update. File : fedora_2008-10917.nasl - Type : ACT_GATHER_INFO |
Alert History
| Date | Informations |
|---|---|
| 2014-02-17 11:52:08 |
|
