CVE-2010-2431

Loading...

General

Score:2.6/10.0
Severity:Low
Category:Path Manipulation

Impact Metrics

Confidentiality:None
Integrity:Partial
Availability:Partial

Exploitability Metrics

Access Vector:Local
Access Complexity:High
Authentication:None

Relative vulnerabilities

CVE-2008-5183, CVE-2009-3553, CVE-2010-0540, CVE-2010-0542, CVE-2010-1748, CVE-2010-2432, CVE-2010-2941

Published on 22/06/10 - Updated on 15/05/13

Description

The cupsFileOpen function in CUPS before 1.4.4 allows local users, with lp group membership, to overwrite arbitrary files via a symlink attack on the (1) /var/cache/cups/remote.cache or (2) /var/cache/cups/job.cache file.

Category: Path Manipulation

CWE-59 (Link Following)
The software attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

Security Notices

US National Vulnerability DatabaseCVE-2010-2431
CentOS CESA-2010:0811
Debian DSA-2176-1
Oracle Linux ELSA-2010-0811
Redhat RHSA-2010:0811
Renater 2011/VULN168

Exploits

No exploits available for this CVE in our database.

Relative technologies

VendorProduct
applecups

Share this vulnerability with:

Twitter Facebook LinkedIn Mail