[Forgot Password]
Login  Register Subscribe

23631

 
 

119105

 
 

98250

 
 

909

 
 

79281

 
 

109

Paid content will be excluded from the download.


Download | Alert*
CVE
view XML

CVE-2012-5519

Date: (C)2012-11-20   (M)2017-12-01 


CUPS 1.4.4, when running in certain Linux distributions such as Debian GNU/Linux, stores the web interface administrator key in /var/run/cups/certs/0 using certain permissions, which allows local users in the lpadmin group to read or write arbitrary files as root by leveraging the web interface.

CVSS Score: 7.2Access Vector: LOCAL
Exploit Score: 3.9Access Complexity: LOW
Impact Score: 10.0Authentication: NONE
 Confidentiality: COMPLETE
 Integrity: COMPLETE
 Availability: COMPLETE





Reference:
BID-56494
APPLE-SA-2013-06-04-1
IAVM:2013-A-0113
RHSA-2013:0580
SUSE-SU-2015:1041
SUSE-SU-2015:1044
USN-1654-1
http://www.openwall.com/lists/oss-security/2012/11/10/5
http://www.openwall.com/lists/oss-security/2012/11/11/5
cups-systemgroup-priv-esc(80012)
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=692791
http://support.apple.com/kb/HT5784
openSUSE-SU-2015:1056

CPE    1
cpe:/a:apple:cups:1.4.4
CWE    1
CWE-264
OVAL    14
oval:org.secpod.oval:def:302984
oval:org.secpod.oval:def:1600216
oval:org.secpod.oval:def:1300145
oval:org.secpod.oval:def:202570
...

© 2013 SecPod Technologies