CVE-2004-2154 — Improper Handling of Case Sensitivity in Apple Cups

CWE-178 — Improper Handling of Case Sensitivity8 documents8 sources
Severity
9.8CRITICALNVD
EPSS
0.5%
top 34.53%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Apple CupsCanonical Ubuntu Linux
Timeline
PublishedDec 31
Latest updateApr 29

Description

CUPS before 1.1.21rc1 treats a Location directive in cupsd.conf as case sensitive, which allows attackers to bypass intended ACLs via a printer name containing uppercase or lowercase letters that are different from what is specified in the directive.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages2 packages

▶NVDapple/cups< 1.1.21+1
▶Debianapple/cups< 1.1.20final+rc1-1+3

Also affects: Ubuntu Linux 4.10

Patches

Patch: www.cups.org ↗Patch: www.cups.org ↗

🔴Vulnerability Details

3
GHSA
GHSA-vp74-83h5-6967: CUPS before 1↗2022-04-29
▶
CVEList
CVE-2004-2154: CUPS before 1↗2005-07-05
▶
OSV
CVE-2004-2154: CUPS before 1↗2004-12-31
▶

📋Vendor Advisories

3
Ubuntu
CUPS vulnerability↗2005-09-20
▶
Red Hat
security flaw↗2004-05-05
▶
Debian
CVE-2004-2154: cups - CUPS before 1.1.21rc1 treats a Location directive in cupsd.conf as case sensitiv...↗2004
▶

💬Community

1
Bugzilla
CVE-2004-2154 security flaw↗2018-08-16
▶
CVE-2004-2154 — Improper Handling of Case Sensitivity | cvebase