CVE-2009-0164

2009-04-2415:30:00

CWE-20

[email protected]

web.nvd.nist.gov

cups

web interface

http host header

validation

remote attackers

dns rebinding attacks

cve-2009-0164

6.2 Medium

AI Score

Confidence

Low

6.4 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:P/A:P

0.01 Low

EPSS

Percentile

83.2%

JSON

The web interface for CUPS before 1.3.10 does not validate the HTTP Host header in a client request, which makes it easier for remote attackers to conduct DNS rebinding attacks.

CPENameOperatorVersion
apple:cupsapple cupseq1.1.20
apple:cupsapple cupseq1.1.5-2
apple:cupsapple cupseq1.1.14
apple:cupsapple cupseq1.3
apple:cupsapple cupseq1.1.6-1
apple:cupsapple cupseq1.1.18
apple:cupsapple cupseq1.1.12
apple:cupsapple cupseq1.1.5-1
apple:cupsapple cupseq1.3.3
apple:cupsapple cupseq1.1.22

CPE	Name	Operator	Version
apple:cups	apple cups	eq	1.1.20
apple:cups	apple cups	eq	1.1.5-2
apple:cups	apple cups	eq	1.1.14
apple:cups	apple cups	eq	1.3
apple:cups	apple cups	eq	1.1.6-1
apple:cups	apple cups	eq	1.1.18
apple:cups	apple cups	eq	1.1.12
apple:cups	apple cups	eq	1.1.5-1
apple:cups	apple cups	eq	1.3.3
apple:cups	apple cups	eq	1.1.22