vulnwire
7.5high

CVE-2017-18190

A localhost.localdomain whitelist entry in valid_host() in scheduler/client.c in CUPS before 2.2.2 allows remote attackers to execute arbit…

Published 8 y ago · modified 4 mo ago · JSON

CVSS
7.5
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
2.9%
percentile 87%
Public exploits
0
none known

A localhost.localdomain whitelist entry in valid_host() in scheduler/client.c in CUPS before 2.2.2 allows remote attackers to execute arbitrary IPP commands by sending POST requests to the CUPS daemon in conjunction with DNS rebinding. The localhost.localdomain name is often resolved via a DNS server (neither the OS nor the web browser is responsible for ensuring that localhost.localdomain is 127.0.0.1).

Exploit prediction (EPSS)

2.92% probability of exploitation in the next 30 days, higher than 87% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD3.07.5CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
NVD2.05.0AV:N/AC:L/Au:N/C:N/I:P/A:N

Classification

Weakness
  • CWE-290 Authentication Bypass by Spoofing

References

  • usn.ubuntu.com /3577-1/ · vendor-advisory, x_refsource_UBUNTU, x_transferred
  • lists.debian.org /debian-lts-announce/2018/07/msg00003.html · mailing-list, x_refsource_MLIST, x_transferred
  • github.com /apple/cups/commit/afa80cb2b457bf8d64f775bed307588610476c41 · x_refsource_MISC, x_transferred
  • lists.debian.org /debian-lts-announce/2018/02/msg00023.html · mailing-list, x_refsource_MLIST, x_transferred
  • bugs.chromium.org /p/project-zero/issues/detail?id=1048 · x_refsource_MISC, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.