low
2.6
CWE
59
Advisory Published
CVE Published
Updated

CVE-2010-2431

First published: Thu Jun 17 2010(Updated: )

Quoting from the upstream bug report <a href="http://cups.org/str.php?L3510">http://cups.org/str.php?L3510</a>: directory that is writable by unprivileged processes. This is a latent privilege escalation vulnerability. It can be exploited only in the presence of other CUPS vulnerabilities. Why this is privilege escalation -------------------------------- This is privilege escalation, because an unprivileged process can trick the CUPS server into overwriting arbitrary files as root. Example: drwxrwxr-x 4 root lp /var/cache/cups -rw-r----- 1 root lp /var/cache/cups/remote.cache This file is opened with cupsFileOpen() which simply opens the file with open(filename, O_WRONLY | O_TRUNC | O_CREAT | O_LARGEFILE | O_BINARY, 0666). If a CUPS "external" program has a vulnerability, an attacker can use the group=lp privileges to replace /var/cache/cups/remote.cache with a symlink to a root-writable file. CUPS will then overwrite that file as root. A similar latent vulnerability exists for the state file /var/cache/cups/job.cache. Why this is a latent vulnerability ---------------------------------- This is a latent vulnerability, because there is no known exploit for CUPS "external" programs that run as user=lp, group=lp. The upstream fix looks more like a preventative fix as there does not seem to be anything exploitable here, so this looks like more a hardening than a response to an actual flaw.

Credit: cve@mitre.org

Affected SoftwareAffected VersionHow to fix
CUPS<=1.4.3
CUPS=1.1
CUPS=1.1.1
CUPS=1.1.2
CUPS=1.1.3
CUPS=1.1.4
CUPS=1.1.5
CUPS=1.1.5-1
CUPS=1.1.5-2
CUPS=1.1.6
CUPS=1.1.6-1
CUPS=1.1.6-2
CUPS=1.1.6-3
CUPS=1.1.7
CUPS=1.1.8
CUPS=1.1.9
CUPS=1.1.9-1
CUPS=1.1.10
CUPS=1.1.10-1
CUPS=1.1.11
CUPS=1.1.12
CUPS=1.1.13
CUPS=1.1.14
CUPS=1.1.15
CUPS=1.1.16
CUPS=1.1.17
CUPS=1.1.18
CUPS=1.1.19
CUPS=1.1.19-rc1
CUPS=1.1.19-rc2
CUPS=1.1.19-rc3
CUPS=1.1.19-rc4
CUPS=1.1.19-rc5
CUPS=1.1.20
CUPS=1.1.20-rc1
CUPS=1.1.20-rc2
CUPS=1.1.20-rc3
CUPS=1.1.20-rc4
CUPS=1.1.20-rc5
CUPS=1.1.20-rc6
CUPS=1.1.21
CUPS=1.1.21-rc1
CUPS=1.1.21-rc2
CUPS=1.1.22
CUPS=1.1.22-rc1
CUPS=1.1.22-rc2
CUPS=1.1.23
CUPS=1.1.23-rc1
CUPS=1.2-b1
CUPS=1.2-b2
CUPS=1.2-rc1
CUPS=1.2-rc2
CUPS=1.2-rc3
CUPS=1.2.0
CUPS=1.2.1
CUPS=1.2.2
CUPS=1.2.3
CUPS=1.2.4
CUPS=1.2.5
CUPS=1.2.6
CUPS=1.2.7
CUPS=1.2.8
CUPS=1.2.9
CUPS=1.2.10
CUPS=1.2.11
CUPS=1.2.12
CUPS=1.3-b1
CUPS=1.3-rc1
CUPS=1.3-rc2
CUPS=1.3.0
CUPS=1.3.1
CUPS=1.3.2
CUPS=1.3.3
CUPS=1.3.4
CUPS=1.3.5
CUPS=1.3.6
CUPS=1.3.7
CUPS=1.3.8
CUPS=1.3.9
CUPS=1.3.10
CUPS=1.3.11
CUPS=1.4.0
CUPS=1.4.1
CUPS=1.4.2

Remedy

http://cups.org/articles.php?L596

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

Reference Links

Frequently Asked Questions

  • What is the severity of CVE-2010-2431?

    CVE-2010-2431 is classified as a latent privilege escalation vulnerability.

  • How can CVE-2010-2431 be exploited?

    CVE-2010-2431 can only be exploited in conjunction with other vulnerabilities in CUPS.

  • What versions of CUPS are affected by CVE-2010-2431?

    CVE-2010-2431 affects various versions of Apple CUPS up to 1.4.3.

  • What measures can be taken to mitigate CVE-2010-2431?

    To mitigate CVE-2010-2431, ensure you upgrade to a patched version of CUPS above 1.4.3.

  • Is CVE-2010-2431 still a concern for current systems?

    CVE-2010-2431 may still pose a risk if associated vulnerabilities are present in older systems running vulnerable CUPS versions.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2025 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203