| Description: |
cupsd in CUPS before 1.3.8 allows local users, and possibly remote
attackers, to cause a denial of service (daemon crash) by adding a large
number of RSS Subscriptions, which triggers a NULL pointer
dereference. NOTE: this issue can be triggered remotely by leveraging
CVE-2008-5184.
The web interface (cgi-bin/admin.c) in CUPS before 1.3.8 uses the guest
username when a user is not logged on to the web server, which makes it
easier for remote attackers to bypass intended policy and conduct CSRF
attacks via the (1) add and (2) cancel RSS subscription functions. |
