Credentials Management Affecting cups package, versions <1.3.8-1
Threat Intelligence
EPSS
1.26% (86th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-DEBIAN9-CUPS-364461
- published 21 Nov 2008
- disclosed 21 Nov 2008
Introduced: 21 Nov 2008
CVE-2008-5184 Open this link in a new tabHow to fix?
Upgrade Debian:9 cups to version 1.3.8-1 or higher.
NVD Description
Note: Versions mentioned in the description apply only to the upstream cups package and not the cups package as distributed by Debian.
See How to fix? for Debian:9 relevant fixed versions and status.
The web interface (cgi-bin/admin.c) in CUPS before 1.3.8 uses the guest username when a user is not logged on to the web server, which makes it easier for remote attackers to bypass intended policy and conduct CSRF attacks via the (1) add and (2) cancel RSS subscription functions.
References
- https://security-tracker.debian.org/tracker/CVE-2008-5184
- http://www.cups.org/str.php?L2774
- http://www.gnucitizen.org/blog/pwning-ubuntu-via-cups/
- http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00002.html
- http://www.openwall.com/lists/oss-security/2008/11/19/3
- http://www.mandriva.com/security/advisories?name=MDVSA-2009:028
CVSS Scores
version 3.1