REDHAT-BUG-490597: Low severity apple CUPS vulnerability
Aaron Sigel of Apple Product Security reported that CUPS did not check Host: HTTP header in the connections to the daemon. This insufficient checking may be of an advantage as part of some other attack, e.g. DNS rebinding attack (however, for such attack, user's web browser or browser plugin must be prone to the DNS rebinding attack).
Upstream patch adds check for the Host: header used in clients' requests. It also introduced ServerAlias configuration directive, that must be used to allow clients to use additional valid host names besides those set has hostname or hostname's aliases.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-490597?
The severity of REDHAT-BUG-490597 is considered critical due to insufficient validation of the Host: HTTP header.
How do I fix REDHAT-BUG-490597?
To fix REDHAT-BUG-490597, ensure to update the CUPS application to the latest version that addresses the vulnerability.
What are the potential impacts of REDHAT-BUG-490597?
The potential impacts of REDHAT-BUG-490597 include exploitation via DNS rebinding attacks, allowing unauthorized access to resources.
Which software is affected by REDHAT-BUG-490597?
The software affected by REDHAT-BUG-490597 is Apple CUPS.
Who reported the vulnerability REDHAT-BUG-490597?
The vulnerability REDHAT-BUG-490597 was reported by Aaron Sigel of Apple Product Security.