CVE-2015-1158
CUPS < 2.0.3 - Remote Command Execution
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
2Exploited in Wild
-Decision
Descriptions
The add_job function in scheduler/ipp.c in cupsd in CUPS before 2.0.3 performs incorrect free operations for multiple-value job-originating-host-name attributes, which allows remote attackers to trigger data corruption for reference-counted strings via a crafted (1) IPP_CREATE_JOB or (2) IPP_PRINT_JOB request, as demonstrated by replacing the configuration file and consequently executing arbitrary code.
La función add_job en scheduler/ipp.c en cupsd en CUPS anterior a 2.0.3 realiza incorrectamente las operaciones libres para los atributos de los nombres de anfitriones que originan trabajos de múltiples valores, lo que permite a atacantes remotos provocar la corrupción de datos para las cadenas de referencias contadas a través de una solicitud (1) IPP_CREATE_JOB o (2) IPP_PRINT_JOB manipulada, tal y como fue demostrado mediante el remplazo del fichero de configuración y como consecuencia la ejecución de código arbitrario.
A string reference count bug was found in cupsd, causing premature freeing of string objects. An attacker could submit a malicious print job that exploits this flaw to dismantle ACLs protecting privileged operations, allowing a replacement configuration file to be uploaded, which in turn allowed the attacker to run arbitrary code on the CUPS server.
CUPS versions prior to 2.0.3 suffers from improper teardown and cross site scripting vulnerabilities.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2015-01-16 CVE Reserved
- 2015-06-10 CVE Published
- 2024-07-20 EPSS Updated
- 2024-08-06 CVE Updated
- 2024-08-06 First Exploit
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-254: 7PK - Security Features
CAPEC
References (21)
| URL | Tag | Source |
|---|---|---|
| http://googleprojectzero.blogspot.in/2015/06/owning-internet-printing-case-study-in.html | X_refsource_misc | |
| http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10702 | X_refsource_confirm | |
| http://www.kb.cert.org/vuls/id/810572 | Third Party Advisory |
|
| http://www.securityfocus.com/bid/75098 | Vdb Entry | |
| http://www.securitytracker.com/id/1032556 | Vdb Entry | |
| https://bugzilla.opensuse.org/show_bug.cgi?id=924208 | X_refsource_confirm | |
| https://code.google.com/p/google-security-research/issues/detail?id=455 | X_refsource_misc | |
| https://github.com/0x00string/oldays/blob/master/CVE-2015-1158.py | X_refsource_misc |
| URL | Date | SRC |
|---|---|---|
| https://www.exploit-db.com/exploits/41233 | 2024-08-06 | |
| https://www.exploit-db.com/exploits/37336 | 2024-08-06 |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00003.html | 2017-09-23 | |
| http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00006.html | 2017-09-23 | |
| http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00010.html | 2017-09-23 | |
| http://rhn.redhat.com/errata/RHSA-2015-1123.html | 2017-09-23 | |
| http://www.cups.org/blog.php?L1082 | 2017-09-23 | |
| http://www.debian.org/security/2015/dsa-3283 | 2017-09-23 | |
| http://www.ubuntu.com/usn/USN-2629-1 | 2017-09-23 | |
| https://bugzilla.redhat.com/show_bug.cgi?id=1221641 | 2015-06-17 | |
| https://security.gentoo.org/glsa/201510-07 | 2017-09-23 | |
| https://www.cups.org/str.php?L4609 | 2017-09-23 | |
| https://access.redhat.com/security/cve/CVE-2015-1158 | 2015-06-17 |