CVE-2002-1372
published 2002-12-26CVE-2002-1372: Common Unix Printing System (CUPS) 1.1.14 through 1.1.17 does not properly check the return values of various file and socket operations, which could allow a…
PriorityP424high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
2.97%
85.8th percentile
Common Unix Printing System (CUPS) 1.1.14 through 1.1.17 does not properly check the return values of various file and socket operations, which could allow a remote attacker to cause a denial of service (resource exhaustion) by causing file descriptors to be assigned and not released, as demonstrated by fanta.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | cups | >= 0 < 1.1.18-1 | 1.1.18-1 |
| apple | cups | >= 0 < 1.1.18-1 | 1.1.18-1 |
| apple | cups | >= 0 < 1.1.18-1 | 1.1.18-1 |
| apple | cups | >= 0 < 1.1.18-1 | 1.1.18-1 |
| apple | cups | 1.1.14 – 1.1.17 | — |
| apple | mac_os_x | — | — |
| apple | mac_os_x | — | — |
| debian | cups | < cups 1.1.18-1 (bookworm) | cups 1.1.18-1 (bookworm) |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
osv7.5HIGH
vendor_debian7.5HIGH
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-pj56-w5gq-p5wr: Common Unix Printing System (CUPS) 1
ghsa_unreviewed·2022-04-30
CVE-2002-1372 [MEDIUM] CWE-252 GHSA-pj56-w5gq-p5wr: Common Unix Printing System (CUPS) 1
Common Unix Printing System (CUPS) 1.1.14 through 1.1.17 does not properly check the return values of various file and socket operations, which could allow a remote attacker to cause a denial of service (resource exhaustion) by causing file descriptors to be assigned and not released, as demonstrated by fanta.
OSV
CVE-2002-1372: Common Unix Printing System (CUPS) 1
osv·2002-12-26·CVSS 7.5
CVE-2002-1372 [HIGH] CVE-2002-1372: Common Unix Printing System (CUPS) 1
Common Unix Printing System (CUPS) 1.1.14 through 1.1.17 does not properly check the return values of various file and socket operations, which could allow a remote attacker to cause a denial of service (resource exhaustion) by causing file descriptors to be assigned and not released, as demonstrated by fanta.
Red Hat
security flaw
vendor_redhat·2002-12-19·CVSS 7.5
CVE-2002-1372 [HIGH] security flaw
security flaw
Common Unix Printing System (CUPS) 1.1.14 through 1.1.17 does not properly check the return values of various file and socket operations, which could allow a remote attacker to cause a denial of service (resource exhaustion) by causing file descriptors to be assigned and not released, as demonstrated by fanta.
Debian
CVE-2002-1372: cups - Common Unix Printing System (CUPS) 1.1.14 through 1.1.17 does not properly check...
vendor_debian·2002·CVSS 7.5
CVE-2002-1372 [HIGH] CVE-2002-1372: cups - Common Unix Printing System (CUPS) 1.1.14 through 1.1.17 does not properly check...
Common Unix Printing System (CUPS) 1.1.14 through 1.1.17 does not properly check the return values of various file and socket operations, which could allow a remote attacker to cause a denial of service (resource exhaustion) by causing file descriptors to be assigned and not released, as demonstrated by fanta.
Scope: local
bookworm: resolved (fixed in 1.1.18-1)
bullseye: resolved (fixed in 1.1.18-1)
forky: resolved (fixed in 1.1.18-1)
sid: resolved (fixed in 1.1.18-1)
trixie: resolved (fixed in 1.1.18-1)
No detection rules found.
No public exploits indexed.
CWE
Improper Resource Shutdown or Release
mitre_cwe
CWE-404 Improper Resource Shutdown or Release
CWE-404: Improper Resource Shutdown or Release
The product does not release or incorrectly releases a resource before it is made available for re-use.
When a resource is created or allocated, the developer is responsible for properly releasing the resource as well as accounting for all potential paths of expiration or invalidation, such as a set period of time or revocation.
Modes of Introduction:
Phase: Implementation
Common Consequences:
Scope: Availability, Other. Impact: DoS: Resource Consumption (Other), Varies by Context. Most unreleased resource issues result in general software reliability problems, but if an attacker can intentionally trigger a resource leak, the attacker might be able to launch a denial of service attack by depleting the resource pool.
Scope: Confidentiality.
CWE
Missing Release of Resource after Effective Lifetime
mitre_cwe
CWE-772 Missing Release of Resource after Effective Lifetime
CWE-772: Missing Release of Resource after Effective Lifetime
The product does not release a resource after its effective lifetime has ended, i.e., after the resource is no longer needed.
Modes of Introduction:
Phase: Implementation
Common Consequences:
Scope: Availability. Impact: DoS: Resource Consumption (Other), DoS: Resource Consumption (Memory), DoS: Resource Consumption (CPU). An attacker that can influence the allocation of resources that are not properly released could deplete the available resource pool and prevent all other processes from accessing the same type of resource. Frequently-affected resources include memory, CPU, disk space, power or battery, etc.
Detection Methods:
Automated Static Analysis: Automated static analysis, commonly referred to as Static Application S
CWE
Unchecked Return Value
mitre_cwe
CWE-252 Unchecked Return Value
CWE-252: Unchecked Return Value
The product does not check the return value from a method or function, which can prevent it from detecting unexpected states and conditions.
Two common programmer assumptions are "this function call can never fail" and "it doesn't matter if this function call fails". If an attacker can force the function to fail or otherwise return a value that is not expected, then the subsequent program logic could lead to a vulnerability, because the product is not in a state that the programmer assumes. For example, if the program calls a function to drop privileges but does not check the return code to ensure that privileges were successfully dropped, then the program will continue to operate with the higher privileges.
Background: Many functions will return some val
http://archives.neohapsis.com/archives/vulnwatch/2002-q4/0117.htmlhttp://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000702http://marc.info/?l=bugtraq&m=104032149026670&w=2http://www.debian.org/security/2003/dsa-232http://www.idefense.com/advisory/12.19.02.txthttp://www.mandrakesoft.com/security/advisories?name=MDKSA-2003:001http://www.novell.com/linux/security/advisories/2003_002_cups.htmlhttp://www.redhat.com/support/errata/RHSA-2002-295.htmlhttp://www.securityfocus.com/bid/6440https://exchange.xforce.ibmcloud.com/vulnerabilities/10912http://archives.neohapsis.com/archives/vulnwatch/2002-q4/0117.htmlhttp://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000702http://marc.info/?l=bugtraq&m=104032149026670&w=2http://www.debian.org/security/2003/dsa-232http://www.idefense.com/advisory/12.19.02.txthttp://www.mandrakesoft.com/security/advisories?name=MDKSA-2003:001http://www.novell.com/linux/security/advisories/2003_002_cups.htmlhttp://www.redhat.com/support/errata/RHSA-2002-295.htmlhttp://www.securityfocus.com/bid/6440https://exchange.xforce.ibmcloud.com/vulnerabilities/10912
2002-12-26
Published