CVE-2014-5029: Low severity cups vulnerability

Published Jul 29, 2014

Updated

The web interface in CUPS 1.7.4 allows local users in the lp group to read arbitrary files via a symlink attack on a file in /var/cache/cups/rss/ and language[0] set to null. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-3537.

Affected Software

4 affected components

Apple CUPS=1.7.4

Canonical Ubuntu Linux=10.04

Canonical Ubuntu Linux=12.04

Canonical Ubuntu Linux=14.04

Remediation

Patch Available

https://cups.org/str.php?L4455

Event History

Jul 29, 2014

CVE Published

via MITRE·02:00 PM

Data Sourced

via MITRE·02:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2014-5029?

CVE-2014-5029 is considered a medium severity vulnerability due to its potential for local users to exploit file access.

Who is affected by CVE-2014-5029?

CVE-2014-5029 affects local users in the lp group on systems running CUPS version 1.7.4 as well as several versions of Ubuntu Linux.

How do I fix CVE-2014-5029?

To fix CVE-2014-5029, upgrade CUPS to a version later than 1.7.4 or apply relevant security patches provided by your operating system vendor.

What is the nature of the exploit for CVE-2014-5029?

The exploit for CVE-2014-5029 involves a symlink attack that allows the reading of arbitrary files by manipulating specific file paths.

Is CVE-2014-5029 related to any previous vulnerabilities?

Yes, CVE-2014-5029 exists because of an incomplete fix for CVE-2014-3537.