A localhost.localdomain whitelist entry in valid_host() in scheduler/client.c in CUPS before 2.2.2 allows remote attackers to execute arbitrary IPP commands by sending POST requests to the CUPS daemon in conjunction with DNS rebinding. The localhost.localdomain name is often resolved via a DNS server (neither the OS nor the web browser is responsible for ensuring that localhost.localdomain is 127.0.0.1).
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade cups | Mar 6, 2018 | Feb 16, 2018 |
| Amazon Linux Ami 2 | — | Upgrade cups-debuginfoUpgrade cups-clientUpgrade cups-ipptoolUpgrade cupsUpgrade cups-libsUpgrade cups-filesystemUpgrade cups-lpdUpgrade cups-devel | Oct 28, 2020 | Feb 16, 2018 |
| Centos_linux | — | Upgrade cups-ipptoolUpgrade cups-clientUpgrade cups-filesystemUpgrade cups-debuginfoUpgrade cups-lpdUpgrade cupsUpgrade cups-libsUpgrade cups-devel | Oct 1, 2020 | Feb 16, 2018 |
| Debian | — | Upgrade cups | Feb 19, 2019 | Feb 16, 2018 |
| Huawei Euleros 2_0_sp1 | — | Upgrade cups-filesystemUpgrade cupsUpgrade cups-lpdUpgrade cups-libsUpgrade cups-develUpgrade cups-client | May 2, 2018 | Feb 16, 2018 |
| Huawei Euleros 2_0_sp2 | — | Upgrade cups-libsUpgrade cups-filesystemUpgrade cupsUpgrade cups-develUpgrade cups-clientUpgrade cups-lpd | May 2, 2018 | Feb 16, 2018 |
| Oracle_linux | — | Upgrade cups-ipptoolUpgrade cups-libsUpgrade cupsUpgrade cups-clientUpgrade cups-filesystemUpgrade cups-lpdUpgrade cups-devel | Oct 10, 2020 | Feb 16, 2018 |
| Redhat_linux | — | Upgrade cups-filesystemUpgrade cups-lpdUpgrade cups-develNo solution existsUpgrade cups-clientUpgrade cups-debuginfoUpgrade cups-ipptoolUpgrade cupsUpgrade cups-libs | Oct 1, 2020 | Feb 16, 2018 |
| Suse | — | Upgrade cups-ddkUpgrade cups-develUpgrade cupsUpgrade cups-clientUpgrade cups-libs-32bitUpgrade cups-libs | Mar 10, 2018 | Feb 16, 2018 |
| Ubuntu | — | Upgrade cups | Feb 21, 2018 | Feb 16, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub