|
|
| |
|
| |
cups: arbitrary code execution
| Package(s): | cups |
CVE #(s): | CVE-2010-0393
|
| Created: | March 4, 2010 |
Updated: | April 20, 2010 |
| Description: |
From the Debian advisory:
Ronald Volgers discovered that the lppasswd component of the cups suite,
the Common UNIX Printing System, is vulnerable to format string attacks
due to insecure use of the LOCALEDIR environment variable. An attacker
can abuse this behaviour to execute arbitrary code via crafted localization
files and triggering calls to _cupsLangprintf(). This works as the lppasswd
binary happens to be installed with setuid 0 permissions.
|
| Alerts: |
|
( Log in to post comments)
|
|
|