Summary
Jann Horn discovered that CUPS permitted HTTP requests with the Host
header set to "localhost.localdomain" from the loopback interface. If a
user were tricked in to opening a specially crafted website in their web
browser, an attacker could potentially exploit this to obtain sensitive
information or control printers, via a DNS rebinding attack.
(CVE-2017-18190)
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 14.04 LTS 14.04:LTS | cups | 1.7.2-0ubuntu1.9 |
| Ubuntu · 16.04 LTS 16.04:LTS | cups | 2.1.3-4ubuntu0.4 |
Vulnerabilities 1
-
Unscored —
A localhost.localdomain whitelist entry in valid_host() in scheduler/client.c in CUPS before 2.2.2 allows remote attack…
References
-
report
https://ubuntu.com/security/CVE-2017-18190