Executive Summary

Summary
Title Sun Alert 275230 A "use-after-free" Vulnerability in the OpenSolaris Common Unix Printing System (CUPS) may Lead to a Denial of Service (DoS) Condition
Informations
Name SUN-275230 First vendor Publication 2010-01-07
Vendor Sun Last vendor Modification 2010-01-07
Severity (Vendor) N/A Revision N/A

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:N/I:N/A:P)
Cvss Base Score 5 Attack Range Network
Cvss Impact Score 2.9 Attack Complexity Low
Cvss Expoit Score 10 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Product: OpenSolaris

A "use-after-free" security vulnerability has been identified in theCommon Unix Printing System (CUPS) related to handling references inits file descriptors-handling interface. This vulnerability may allow alocal or remote unprivileged user to crash cupsd(8) via a speciallycrafted query to get the list of current print jobs for a specificprinter, resulting in a Denial of Service (DoS).

This issue is also described in the following document:

CVE-2009-3553 at: http://www.security-database.com/detail.php?cve=CVE-2009-3553

State: Resolved
First released: 07-Jan-2010

Original Source

Url : http://blogs.sun.com/security/entry/sun_alert_275230_a_use

CWE : Common Weakness Enumeration

% Id Name
100 % CWE-416 Use After Free

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:11183
 
Oval ID: oval:org.mitre.oval:def:11183
Title: Use-after-free vulnerability in the abstract file-descriptor handling interface in the cupsdDoSelect function in scheduler/select.c in the scheduler in cupsd in CUPS 1.3.7 and 1.3.10 allows remote attackers to cause a denial of service (daemon crash or hang) via a client disconnection during listing of a large number of print jobs, related to improperly maintaining a reference count. NOTE: some of these details are obtained from third party information.
Description: Use-after-free vulnerability in the abstract file-descriptor handling interface in the cupsdDoSelect function in scheduler/select.c in the scheduler in cupsd in CUPS 1.3.7 and 1.3.10 allows remote attackers to cause a denial of service (daemon crash or hang) via a client disconnection during listing of a large number of print jobs, related to improperly maintaining a reference count. NOTE: some of these details are obtained from third party information.
Family: unix Class: vulnerability
Reference(s): CVE-2009-3553
Version: 5
Platform(s): Red Hat Enterprise Linux 5
CentOS Linux 5
Oracle Linux 5
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:22727
 
Oval ID: oval:org.mitre.oval:def:22727
Title: ELSA-2009:1595: cups security update (Moderate)
Description: Use-after-free vulnerability in the abstract file-descriptor handling interface in the cupsdDoSelect function in scheduler/select.c in the scheduler in cupsd in CUPS 1.3.7 and 1.3.10 allows remote attackers to cause a denial of service (daemon crash or hang) via a client disconnection during listing of a large number of print jobs, related to improperly maintaining a reference count. NOTE: some of these details are obtained from third party information.
Family: unix Class: patch
Reference(s): ELSA-2009:1595-02
CVE-2009-2820
CVE-2009-3553
Version: 13
Platform(s): Oracle Linux 5
Product(s): cups
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 2
Application 2
Os 70
Os 65
Os 5
Os 1
Os 1
Os 1

OpenVAS Exploits

Date Description
2012-08-10 Name : Gentoo Security Advisory GLSA 201207-10 (cups)
File : nvt/glsa_201207_10.nasl
2011-08-09 Name : CentOS Update for cups CESA-2009:1595 centos5 i386
File : nvt/gb_CESA-2009_1595_cups_centos5_i386.nasl
2011-08-09 Name : CentOS Update for cups CESA-2010:0129 centos5 i386
File : nvt/gb_CESA-2010_0129_cups_centos5_i386.nasl
2011-03-09 Name : Debian Security Advisory DSA 2176-1 (cups)
File : nvt/deb_2176_1.nasl
2010-11-23 Name : Fedora Update for cups FEDORA-2010-17627
File : nvt/gb_fedora_2010_17627_cups_fc12.nasl
2010-07-30 Name : Fedora Update for cups FEDORA-2010-10101
File : nvt/gb_fedora_2010_10101_cups_fc12.nasl
2010-06-28 Name : Fedora Update for cups FEDORA-2010-10066
File : nvt/gb_fedora_2010_10066_cups_fc11.nasl
2010-04-16 Name : Mandriva Update for cups MDVSA-2010:073-1 (cups)
File : nvt/gb_mandriva_MDVSA_2010_073_1.nasl
2010-04-16 Name : Mandriva Update for cups MDVSA-2010:073 (cups)
File : nvt/gb_mandriva_MDVSA_2010_073.nasl
2010-04-06 Name : Mac OS X Security Update 2010-001
File : nvt/macosx_secupd_2010-001.nasl
2010-03-22 Name : Fedora Update for cups FEDORA-2010-2743
File : nvt/gb_fedora_2010_2743_cups_fc11.nasl
2010-03-12 Name : Fedora Update for cups FEDORA-2010-3761
File : nvt/gb_fedora_2010_3761_cups_fc12.nasl
2010-03-05 Name : RedHat Update for cups RHSA-2010:0129-01
File : nvt/gb_RHSA-2010_0129-01_cups.nasl
2010-03-05 Name : Ubuntu Update for cups, cupsys vulnerabilities USN-906-1
File : nvt/gb_ubuntu_USN_906_1.nasl
2010-02-19 Name : Mandriva Update for dhcp MDVA-2010:073 (dhcp)
File : nvt/gb_mandriva_MDVA_2010_073.nasl
2009-12-10 Name : Fedora Core 10 FEDORA-2009-12652 (cups)
File : nvt/fcore_2009_12652.nasl
2009-12-10 Name : Fedora Core 12 FEDORA-2009-11314 (cups)
File : nvt/fcore_2009_11314.nasl
2009-12-10 Name : Fedora Core 11 FEDORA-2009-10891 (cups)
File : nvt/fcore_2009_10891.nasl
2009-12-01 Name : CUPS File Descriptors Handling Remote Denial Of Service Vulnerability
File : nvt/cups_37048.nasl
2009-11-23 Name : RedHat Security Advisory RHSA-2009:1595
File : nvt/RHSA_2009_1595.nasl

Open Source Vulnerability Database (OSVDB)

Id Description
60204 CUPS scheduler/select.c cupsdDoSelect() Function Use-after-free DoS

Nessus® Vulnerability Scanner

Date Description
2013-07-12 Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2010-0129.nasl - Type : ACT_GATHER_INFO
2013-07-12 Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2009-1595.nasl - Type : ACT_GATHER_INFO
2013-06-29 Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2009-1595.nasl - Type : ACT_GATHER_INFO
2012-08-01 Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20100303_cups_on_SL5_x.nasl - Type : ACT_GATHER_INFO
2012-07-10 Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-201207-10.nasl - Type : ACT_GATHER_INFO
2011-03-02 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-2176.nasl - Type : ACT_GATHER_INFO
2010-07-08 Name : The remote printer service is affected by multiple vulnerabilities.
File : cups_1_4_4.nasl - Type : ACT_GATHER_INFO
2010-07-01 Name : The remote Fedora host is missing a security update.
File : fedora_2010-2743.nasl - Type : ACT_GATHER_INFO
2010-07-01 Name : The remote Fedora host is missing a security update.
File : fedora_2010-3693.nasl - Type : ACT_GATHER_INFO
2010-07-01 Name : The remote Fedora host is missing a security update.
File : fedora_2010-3761.nasl - Type : ACT_GATHER_INFO
2010-04-16 Name : The remote printer service is affected by multiple vulnerabilities.
File : cups_1_4_3.nasl - Type : ACT_GATHER_INFO
2010-04-15 Name : The remote Mandriva Linux host is missing one or more security updates.
File : mandriva_MDVSA-2010-073.nasl - Type : ACT_GATHER_INFO
2010-03-19 Name : The remote SuSE 11 host is missing one or more security updates.
File : suse_11_cups-100210.nasl - Type : ACT_GATHER_INFO
2010-03-19 Name : The remote openSUSE host is missing a security update.
File : suse_11_2_cups-100305.nasl - Type : ACT_GATHER_INFO
2010-03-19 Name : The remote openSUSE host is missing a security update.
File : suse_11_1_cups-100210.nasl - Type : ACT_GATHER_INFO
2010-03-19 Name : The remote openSUSE host is missing a security update.
File : suse_11_0_cups-100210.nasl - Type : ACT_GATHER_INFO
2010-03-15 Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2010-0129.nasl - Type : ACT_GATHER_INFO
2010-03-04 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2010-0129.nasl - Type : ACT_GATHER_INFO
2010-03-04 Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-906-1.nasl - Type : ACT_GATHER_INFO
2010-01-20 Name : The remote host is missing a Mac OS X update that fixes various security issues.
File : macosx_SecUpd2010-001.nasl - Type : ACT_GATHER_INFO
2009-12-27 Name : The remote openSUSE host is missing a security update.
File : suse_11_0_cups-091210.nasl - Type : ACT_GATHER_INFO
2009-12-27 Name : The remote openSUSE host is missing a security update.
File : suse_11_1_cups-091210.nasl - Type : ACT_GATHER_INFO
2009-12-11 Name : The remote openSUSE host is missing a security update.
File : suse_11_2_cups-091204.nasl - Type : ACT_GATHER_INFO
2009-12-07 Name : The remote Fedora host is missing a security update.
File : fedora_2009-12652.nasl - Type : ACT_GATHER_INFO
2009-12-01 Name : The remote Fedora host is missing a security update.
File : fedora_2009-11314.nasl - Type : ACT_GATHER_INFO
2009-12-01 Name : The remote Fedora host is missing a security update.
File : fedora_2009-10891.nasl - Type : ACT_GATHER_INFO
2009-11-19 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2009-1595.nasl - Type : ACT_GATHER_INFO