CVE-2010-2432: Medium severity cups vulnerability

Q: What is the severity of CVE-2010-2432?

CVE-2010-2432 is classified as a denial of service vulnerability that can lead to an infinite loop in affected versions of CUPS.

Q: How do I fix CVE-2010-2432?

To fix CVE-2010-2432, upgrade your CUPS installation to version 1.4.4 or later.

Q: Which CUPS versions are affected by CVE-2010-2432?

CVE-2010-2432 affects CUPS versions prior to 1.4.4, including specific earlier versions such as 1.1.20, 1.1.18, 1.3.9, and others.

Q: What component of CUPS is impacted by CVE-2010-2432?

The vulnerability is found in the cupsDoAuthentication function within the auth.c file of CUPS.

Q: Can CVE-2010-2432 be exploited remotely?

Yes, CVE-2010-2432 can be exploited remotely by sending HTTP_UNAUTHORIZED responses that trigger the denial of service condition.

Published Jun 22, 2010

Updated

The cupsDoAuthentication function in auth.c in the client in CUPS before 1.4.4, when HAVEGSSAPI is omitted, does not properly handle a demand for authorization, which allows remote CUPS servers to cause a denial of service (infinite loop) via HTTPUNAUTHORIZED responses.

Affected Software

84 affected components

apple CUPS=1.1.20

apple CUPS=1.1.5-2

apple CUPS=1.3.9

apple CUPS=1.1.14

apple CUPS=1.3-rc2

apple CUPS=1.1.6-1

apple CUPS=1.1.18

apple CUPS=1.1.12

apple CUPS<=1.4.3

apple CUPS=1.3.11

apple CUPS=1.1.5-1

apple CUPS=1.3.3

apple CUPS=1.1.22

apple CUPS=1.2.0

apple CUPS=1.1.16

apple CUPS=1.4.1

apple CUPS=1.3.1

apple CUPS=1.1.23-rc1

apple CUPS=1.1.20-rc1

apple CUPS=1.1.15

apple CUPS=1.1.17

apple CUPS=1.1.20-rc6

apple CUPS=1.2.4

apple CUPS=1.1.19-rc1

apple CUPS=1.3.2

apple CUPS=1.1.22-rc1

apple CUPS=1.1.7

apple CUPS=1.2-rc2

apple CUPS=1.1.6-2

apple CUPS=1.3-b1

apple CUPS=1.1.3

apple CUPS=1.2.3

apple CUPS=1.1.21

apple CUPS=1.4.0

apple CUPS=1.2.9

apple CUPS=1.2.10

apple CUPS=1.1.4

apple CUPS=1.1.23

apple CUPS=1.2.6

apple CUPS=1.2-b1

apple CUPS=1.3.8

apple CUPS=1.1.20-rc4

apple CUPS=1.1.19

apple CUPS=1.1

apple CUPS=1.3.4

apple CUPS=1.1.8

apple CUPS=1.1.5

apple CUPS=1.2.1

apple CUPS=1.2-rc3

apple CUPS=1.1.2

apple CUPS=1.3.10

apple CUPS=1.1.13

apple CUPS=1.1.19-rc4

apple CUPS=1.1.9-1

apple CUPS=1.2.12

apple CUPS=1.1.21-rc2

apple CUPS=1.2-b2

apple CUPS=1.2.7

apple CUPS=1.1.6-3

apple CUPS=1.1.20-rc5

apple CUPS=1.1.9

apple CUPS=1.3.7

apple CUPS=1.1.19-rc5

apple CUPS=1.2-rc1

apple CUPS=1.1.1

apple CUPS=1.2.8

apple CUPS=1.2.2

apple CUPS=1.4.2

apple CUPS=1.1.10

apple CUPS=1.2.11

apple CUPS=1.1.22-rc2

apple CUPS=1.1.21-rc1

apple CUPS=1.3-rc1

apple CUPS=1.1.11

apple CUPS=1.1.19-rc3

apple CUPS=1.1.6

apple CUPS=1.1.10-1

apple CUPS=1.3.0

apple CUPS=1.3.5

apple CUPS=1.3.6

apple CUPS=1.1.20-rc2

apple CUPS=1.1.20-rc3

apple CUPS=1.2.5

apple CUPS=1.1.19-rc2

Remediation

Patch Available

http://cups.org/articles.php?L596

Event History

Jun 22, 2010

CVE Published

via MITRE·08:24 PM

Data Sourced

via MITRE·08:24 PM

Description

Frequently Asked Questions

What is the severity of CVE-2010-2432?

CVE-2010-2432 is classified as a denial of service vulnerability that can lead to an infinite loop in affected versions of CUPS.

How do I fix CVE-2010-2432?