CVE-2009-0949: Null Pointer Dereference

Published May 15, 2009
·
Updated

Anibal Sacco from Core Security Technologies discovered a NULL pointer dereference flaw in CUPS daemon when handling the IPPTAGUNSUPPORTED, which allows remote attackers with access to CUPS' IPP port to crash cupsd.

Acknowledgements:

Red Hat would like to thank Anibal Sacco from Core Security Technologies for reporting this issue.

Other sources

The ippReadIO function in cups/ipp.c in cupsd in CUPS before 1.3.10 does not properly initialize memory for IPP request packets, which allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a scheduler request with two consecutive IPPTAGUNSUPPORTED tags.

MITRE

Affected Software

93 affected components
Apple CUPS=1.1.20
Apple CUPS=1.1.5-2
Apple CUPS=1.1.14
Apple CUPS=1.3-rc2
Apple CUPS=1.1.6-1
Apple CUPS=1.1.18
Apple CUPS=1.1.12
Apple CUPS=1.1.5-1
Apple CUPS=1.3.3
Apple CUPS=1.1.22
Apple CUPS=1.2.0
Apple CUPS=1.1.16
Apple CUPS=1.3.1
Apple CUPS=1.1.23-rc1
Apple CUPS=1.1.20-rc1
Apple CUPS=1.1.15
Apple CUPS=1.1.17
Apple CUPS=1.1.20-rc6
Apple CUPS=1.2.4
Apple CUPS=1.1.19-rc1
Apple CUPS=1.3.2
Apple CUPS=1.1.22-rc1
Apple CUPS=1.1.7
Apple CUPS=1.2-rc2
Apple CUPS=1.1.6-2
Apple CUPS=1.3-b1
Apple CUPS=1.1.3
Apple CUPS=1.2.3
Apple CUPS=1.1.21
Apple CUPS=1.2.9
Apple CUPS=1.2.10
Apple CUPS=1.1.4
Apple CUPS=1.1.23
Apple CUPS=1.2.6
Apple CUPS=1.2-b1
Apple CUPS=1.3.8
Apple CUPS=1.1.20-rc4
Apple CUPS=1.1.19
Apple CUPS=1.1
Apple CUPS=1.3.4
Apple CUPS=1.1.8
Apple CUPS=1.1.5
Apple CUPS=1.2.1
Apple CUPS=1.2-rc3
Apple CUPS=1.1.2
Apple CUPS=1.1.13
Apple CUPS=1.1.19-rc4
Apple CUPS=1.1.9-1
Apple CUPS=1.2.12
Apple CUPS=1.1.21-rc2
Apple CUPS=1.2-b2
Apple CUPS=1.2.7
Apple CUPS=1.1.6-3
Apple CUPS=1.1.20-rc5
Apple CUPS=1.1.9
Apple CUPS=1.3.7
Apple CUPS=1.1.19-rc5
Apple CUPS=1.2-rc1
Apple CUPS<=1.3.9
Apple CUPS=1.1.1
Apple CUPS=1.2.8
Apple CUPS=1.2.2
Apple CUPS=1.1.10
Apple CUPS=1.2.11
Apple CUPS=1.1.22-rc2
Apple CUPS=1.1.21-rc1
Apple CUPS=1.3-rc1
Apple CUPS=1.1.11
Apple CUPS=1.1.19-rc3
Apple CUPS=1.1.6
Apple CUPS=1.1.10-1
Apple CUPS=1.3.0
Apple CUPS=1.3.5
Apple CUPS=1.3.6
Apple CUPS=1.1.20-rc2
Apple CUPS=1.1.20-rc3
Apple CUPS=1.2.5
Apple CUPS=1.1.19-rc2
Apple CUPS<1.3.10
Canonical Ubuntu Linux=6.06
Canonical Ubuntu Linux=8.04
Canonical Ubuntu Linux=8.10
Canonical Ubuntu Linux=9.04
Debian Debian Linux=4.0
Debian Debian Linux=5.0
Debian Debian Linux=6.0
Apple iOS and macOS>=10.0.0<10.4.11
Apple iOS and macOS>=10.5.0<10.5.8
Apple Mac OS X Server>=10.0.0<10.4.11
Apple Mac OS X Server>=10.5.0<10.5.8
openSUSE openSUSE=10.3
SUSE Linux Enterprise=9.0
SUSE Linux Enterprise=10.0

Event History

May 15, 2009
Data Sourced
via Red Hat·09:22 AM
DescriptionSeverityAffected Software
Jun 9, 2009
CVE Published
via MITRE·05:00 PM
Data Sourced
via MITRE·05:00 PM
Description

Frequently Asked Questions

1

What is the severity of CVE-2009-0949?

CVE-2009-0949 has a severity rating of medium due to its potential to cause denial of service.

2

How do I fix CVE-2009-0949?

To fix CVE-2009-0949, upgrade to CUPS version 1.3.10 or later.

3

What type of attack does CVE-2009-0949 allow?

CVE-2009-0949 allows remote attackers to mount a denial of service attack due to null pointer dereference.

4

Which versions are affected by CVE-2009-0949?

CVE-2009-0949 affects CUPS versions prior to 1.3.10.

5

What component does CVE-2009-0949 affect?

CVE-2009-0949 affects the cupsd component of the CUPS printing system.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203