10

CVE-2008-5184

Exploit
The web interface (cgi-bin/admin.c) in CUPS before 1.3.8 uses the guest username when a user is not logged on to the web server, which makes it easier for remote attackers to bypass intended policy and conduct CSRF attacks via the (1) add and (2) cancel RSS subscription functions.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Apple ≫ Cups Version <= 1.3.7
Apple ≫ Cups Version 1.1
Apple ≫ Cups Version 1.1.1
Apple ≫ Cups Version 1.1.2
Apple ≫ Cups Version 1.1.3
Apple ≫ Cups Version 1.1.4
Apple ≫ Cups Version 1.1.5
Apple ≫ Cups Version 1.1.5-1
Apple ≫ Cups Version 1.1.5-2
Apple ≫ Cups Version 1.1.6
Apple ≫ Cups Version 1.1.6-1
Apple ≫ Cups Version 1.1.6-2
Apple ≫ Cups Version 1.1.6-3
Apple ≫ Cups Version 1.1.7
Apple ≫ Cups Version 1.1.8
Apple ≫ Cups Version 1.1.9
Apple ≫ Cups Version 1.1.9-1
Apple ≫ Cups Version 1.1.10
Apple ≫ Cups Version 1.1.10-1
Apple ≫ Cups Version 1.1.11
Apple ≫ Cups Version 1.1.12
Apple ≫ Cups Version 1.1.13
Apple ≫ Cups Version 1.1.14
Apple ≫ Cups Version 1.1.15
Apple ≫ Cups Version 1.1.16
Apple ≫ Cups Version 1.1.17
Apple ≫ Cups Version 1.1.18
Apple ≫ Cups Version 1.1.19
Apple ≫ Cups Version 1.1.19 Update rc1
Apple ≫ Cups Version 1.1.19 Update rc2
Apple ≫ Cups Version 1.1.19 Update rc3
Apple ≫ Cups Version 1.1.19 Update rc4
Apple ≫ Cups Version 1.1.19 Update rc5
Apple ≫ Cups Version 1.1.20
Apple ≫ Cups Version 1.1.20 Update rc1
Apple ≫ Cups Version 1.1.20 Update rc2
Apple ≫ Cups Version 1.1.20 Update rc3
Apple ≫ Cups Version 1.1.20 Update rc4
Apple ≫ Cups Version 1.1.20 Update rc5
Apple ≫ Cups Version 1.1.20 Update rc6
Apple ≫ Cups Version 1.1.21
Apple ≫ Cups Version 1.1.21 Update rc1
Apple ≫ Cups Version 1.1.21 Update rc2
Apple ≫ Cups Version 1.1.22
Apple ≫ Cups Version 1.1.22 Update rc1
Apple ≫ Cups Version 1.1.22 Update rc2
Apple ≫ Cups Version 1.1.23
Apple ≫ Cups Version 1.1.23 Update rc1
Apple ≫ Cups Version 1.2 Update b1
Apple ≫ Cups Version 1.2 Update b2
Apple ≫ Cups Version 1.2 Update rc1
Apple ≫ Cups Version 1.2 Update rc2
Apple ≫ Cups Version 1.2 Update rc3
Apple ≫ Cups Version 1.2.0
Apple ≫ Cups Version 1.2.1
Apple ≫ Cups Version 1.2.2
Apple ≫ Cups Version 1.2.3
Apple ≫ Cups Version 1.2.4
Apple ≫ Cups Version 1.2.5
Apple ≫ Cups Version 1.2.6
Apple ≫ Cups Version 1.2.7
Apple ≫ Cups Version 1.2.8
Apple ≫ Cups Version 1.2.9
Apple ≫ Cups Version 1.2.10
Apple ≫ Cups Version 1.2.11
Apple ≫ Cups Version 1.2.12
Apple ≫ Cups Version 1.3 Update b1
Apple ≫ Cups Version 1.3 Update rc1
Apple ≫ Cups Version 1.3 Update rc2
Apple ≫ Cups Version 1.3.0
Apple ≫ Cups Version 1.3.1
Apple ≫ Cups Version 1.3.2
Apple ≫ Cups Version 1.3.3
Apple ≫ Cups Version 1.3.4
Apple ≫ Cups Version 1.3.5
Apple ≫ Cups Version 1.3.6
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 3.67% 0.882
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 10 10 10
AV:N/AC:L/Au:N/C:C/I:C/A:C
Es wurden noch keine Informationen zu CWE veröffentlicht.
http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00002.html
http://www.gnucitizen.org/blog/pwning-ubuntu-via-cups/
Exploit
http://www.mandriva.com/security/advisories?name=MDVSA-2009:028
http://www.openwall.com/lists/oss-security/2008/11/19/3
http://www.cups.org/str.php?L2774