CVE-2010-2431

2010-06-2220:30:00

CWE-59

[email protected]

web.nvd.nist.gov

cups

cups before 1.4.4

local users

lp group membership

symlink attack

cve-2010-2431

6 Medium

AI Score

Confidence

Low

2.6 Low

CVSS2

Access Vector

LOCAL

Access Complexity

HIGH

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:H/Au:N/C:N/I:P/A:P

0.0004 Low

EPSS

Percentile

5.3%

JSON

The cupsFileOpen function in CUPS before 1.4.4 allows local users, with lp group membership, to overwrite arbitrary files via a symlink attack on the (1) /var/cache/cups/remote.cache or (2) /var/cache/cups/job.cache file.

CPENameOperatorVersion
apple:cupsapple cupseq1.1.20
apple:cupsapple cupseq1.1.5-2
apple:cupsapple cupseq1.3.9
apple:cupsapple cupseq1.1.14
apple:cupsapple cupseq1.3
apple:cupsapple cupseq1.1.6-1
apple:cupsapple cupseq1.1.18
apple:cupsapple cupseq1.1.12
apple:cupsapple cupsle1.4.3
apple:cupsapple cupseq1.3.11

CPE	Name	Operator	Version
apple:cups	apple cups	eq	1.1.20
apple:cups	apple cups	eq	1.1.5-2
apple:cups	apple cups	eq	1.3.9
apple:cups	apple cups	eq	1.1.14
apple:cups	apple cups	eq	1.3
apple:cups	apple cups	eq	1.1.6-1
apple:cups	apple cups	eq	1.1.18
apple:cups	apple cups	eq	1.1.12
apple:cups	apple cups	le	1.4.3
apple:cups	apple cups	eq	1.3.11