CVE-2008-5183

high-risk
Published 2008-11-21

cupsd in CUPS 1.3.9 and earlier allows local users, and possibly remote attackers, to cause a denial of service (daemon crash) by adding a large number of RSS Subscriptions, which triggers a NULL pointer dereference. NOTE: this issue can be triggered remotely by leveraging CVE-2008-5184.

Do I need to act?

~
4.6% chance of exploitation in next 30 days
EPSS score — moderate exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
!
1 public exploit available
7150
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
7
CVSS 7.5/10 High
NETWORK / LOW complexity

Affected Products (6)

Affected Vendors

Debian Apple Opensuse

References (42)

Broken Link http://lab.gnucitizen.org/projects/cups-0day
Mailing List http://lists.apple.com/archives/security-announce/2009/Feb/msg00000.html
Mailing List http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00002.html
Broken Link http://secunia.com/advisories/33937
Broken Link http://secunia.com/advisories/43521
Third Party Advisory http://support.apple.com/kb/HT3438
Third Party Advisory http://www.debian.org/security/2011/dsa-2176
Broken Link http://www.gnucitizen.org/blog/pwning-ubuntu-via-cups/
Broken Link http://www.mandriva.com/security/advisories?name=MDVSA-2009:028
Mailing List http://www.openwall.com/lists/oss-security/2008/11/19/3
Mailing List http://www.openwall.com/lists/oss-security/2008/11/19/4
Mailing List http://www.openwall.com/lists/oss-security/2008/11/20/1
Broken Link http://www.redhat.com/support/errata/RHSA-2008-1029.html
Broken Link http://www.securityfocus.com/bid/32419
Broken Link http://www.securitytracker.com/id?1021396
Broken Link http://www.vupen.com/english/advisories/2009/0422
Broken Link http://www.vupen.com/english/advisories/2011/0535
Issue Tracking https://bugs.launchpad.net/ubuntu/+source/cups/+bug/298241
Third Party Advisory https://exchange.xforce.ibmcloud.com/vulnerabilities/46684
Broken Link https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3...
and 22 more references
54
/ 100
high-risk
Severity 26/34 · High
Exploitability 15/34 · Moderate
Exposure 13/34 · Low