CVE-2002-1367 Common Unix Printing System (CUPS) 1.1.14 through 1.1.17 allows remote attackers to add printers without authentication via a certain UDP packet, which can then be used to perform unauthorized activit...
HighCVSS 10.0
EPSS 3.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Common Unix Printing System (CUPS) 1.1.14 through 1.1.17 allows remote attackers to add printers without authentication via a certain UDP packet, which can then be used to perform unauthorized activities such as stealing the local root certificate for the administration server via a "need authorization" page, as demonstrated by new-coke.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| easy software products cups | = 1.0.4 | No fix listed |
| easy software products cups | = 1.0.4_8 | No fix listed |
| easy software products cups | = 1.1.1 | No fix listed |
| easy software products cups | = 1.1.4 | No fix listed |
| easy software products cups | = 1.1.4_2 | No fix listed |
| easy software products cups | = 1.1.4_3 | No fix listed |
| easy software products cups | = 1.1.4_5 | No fix listed |
| easy software products cups | = 1.1.6 | No fix listed |
| easy software products cups | = 1.1.7 | No fix listed |
| easy software products cups | = 1.1.10 | No fix listed |
| easy software products cups | = 1.1.13 | No fix listed |
| easy software products cups | = 1.1.14 | No fix listed |
| easy software products cups | = 1.1.17 | No fix listed |
| apple mac os x | = 10.2 | No fix listed |
| apple mac os x | = 10.2.2 | No fix listed |
| debian/cups(Debian:12) | < 1.1.18-1 | 1.1.18-1 |
| debian/cups(Debian:13) | < 1.1.18-1 | 1.1.18-1 |
| debian/cups(Debian:14) | < 1.1.18-1 | 1.1.18-1 |
References
- 20021219 iDEFENSE Security Advisory 12.19.02: Multiple Security Vulnerabilities in Common Unix Printing System (CUPS) mailing-list
- CLSA-2003:702 vendor-advisory
- 20021219 iDEFENSE Security Advisory 12.19.02: Multiple Security Vulnerabilities in Common Unix Printing System (CUPS) mailing-list
- DSA-232 vendor-advisory
- www.idefense.com exploit vendor-advisory
- MDKSA-2003:001 vendor-advisory
- SuSE-SA:2003:002 vendor-advisory
- RHSA-2002:295 vendor-advisory
- 6436 vdb-entry
- cups-udp-add-printers(10908) vdb-entry
- Debian Security Tracker CVE-2002-1367 vendor-advisory