REDHAT-BUG-1128764: Medium severity Apple CUPS vulnerability

Published Aug 11, 2014

Updated

It was reported [1] that CUPS allow local users to read arbitrary files via symlink attack on the directory index files:

index.html index.class index.pl index.php index.pyc index.py

Upstream patches are available at [2] as well.

[1]: http://seclists.org/oss-sec/2014/q3/209 [2]: https://cups.org/str.php?L4455

Affected Software

1 affected component

Apple CUPS

Aug 11, 2014

Data Sourced

via Red Hat·01:59 PM

DescriptionSeverityAffected Software

A local user can exploit it. The reported impact is disclosure of arbitrary files through a symlink attack involving CUPS directory index files.

The affected index filenames are index.html, index.class, index.pl, index.php, index.pyc, and index.py.

Yes. The report states that upstream patches are available from CUPS.