CVE-2009-0164
Severity CVSS v4.0:
Pending analysis
Type:
CWE-20
Input Validation
Publication date:
24/04/2009
Last modified:
11/10/2018
Description
The web interface for CUPS before 1.3.10 does not validate the HTTP Host header in a client request, which makes it easier for remote attackers to conduct DNS rebinding attacks.
Impact
Base Score 2.0
6.40
Severity 2.0
MEDIUM
Vulnerable products and versions
CPE | From | Up to |
---|---|---|
cpe:2.3:a:apple:cups:*:*:*:*:*:*:*:* | 1.3.9 (including) | |
cpe:2.3:a:apple:cups:1.1:*:*:*:*:*:*:* | ||
cpe:2.3:a:apple:cups:1.1.1:*:*:*:*:*:*:* | ||
cpe:2.3:a:apple:cups:1.1.2:*:*:*:*:*:*:* | ||
cpe:2.3:a:apple:cups:1.1.3:*:*:*:*:*:*:* | ||
cpe:2.3:a:apple:cups:1.1.4:*:*:*:*:*:*:* | ||
cpe:2.3:a:apple:cups:1.1.5:*:*:*:*:*:*:* | ||
cpe:2.3:a:apple:cups:1.1.5-1:*:*:*:*:*:*:* | ||
cpe:2.3:a:apple:cups:1.1.5-2:*:*:*:*:*:*:* | ||
cpe:2.3:a:apple:cups:1.1.6:*:*:*:*:*:*:* | ||
cpe:2.3:a:apple:cups:1.1.6-1:*:*:*:*:*:*:* | ||
cpe:2.3:a:apple:cups:1.1.6-2:*:*:*:*:*:*:* | ||
cpe:2.3:a:apple:cups:1.1.6-3:*:*:*:*:*:*:* | ||
cpe:2.3:a:apple:cups:1.1.7:*:*:*:*:*:*:* | ||
cpe:2.3:a:apple:cups:1.1.8:*:*:*:*:*:*:* |
To consult the complete list of CPE names with products and versions, see this page
References to Advisories, Solutions, and Tools
- http://bugs.gentoo.org/show_bug.cgi?id=263070
- http://lists.apple.com/archives/security-announce/2009/May/msg00002.html
- http://secunia.com/advisories/35074
- http://security.gentoo.org/glsa/glsa-200904-20.xml
- http://support.apple.com/kb/HT3549
- http://wiki.rpath.com/Advisories:rPSA-2009-0061
- http://www.cups.org/articles.php?L582=
- http://www.cups.org/str.php?L3118=
- http://www.securityfocus.com/archive/1/502750/100/0/threaded
- http://www.securityfocus.com/bid/34665
- http://www.us-cert.gov/cas/techalerts/TA09-133A.html
- http://www.vupen.com/english/advisories/2009/1297
- https://bugzilla.redhat.com/show_bug.cgi?id=490597