CVE-2009-0949
published 2009-06-09CVE-2009-0949: The ippReadIO function in cups/ipp.c in cupsd in CUPS before 1.3.10 does not properly initialize memory for IPP request packets, which allows remote attackers…
PriorityP350high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EXPLOIT
EPSS
19.63%
97.1th percentile
The ippReadIO function in cups/ipp.c in cupsd in CUPS before 1.3.10 does not properly initialize memory for IPP request packets, which allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a scheduler request with two consecutive IPP_TAG_UNSUPPORTED tags.
Affected
20 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | cups | < 1.3.10 | 1.3.10 |
| apple | cups | >= 0 < 1.3.10-1 | 1.3.10-1 |
| apple | cups | >= 0 < 1.3.10-1 | 1.3.10-1 |
| apple | cups | >= 0 < 1.3.10-1 | 1.3.10-1 |
| apple | cups | >= 0 < 1.3.10-1 | 1.3.10-1 |
| apple | mac_os_x | >= 10.0.0 < 10.4.11 | 10.4.11 |
| apple | mac_os_x | >= 10.5.0 < 10.5.8 | 10.5.8 |
| apple | mac_os_x_server | >= 10.0.0 < 10.4.11 | 10.4.11 |
| apple | mac_os_x_server | >= 10.5.0 < 10.5.8 | 10.5.8 |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| debian | cups | < cups 1.3.10-1 (bookworm) | cups 1.3.10-1 (bookworm) |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| opensuse | opensuse | — | — |
| suse | linux_enterprise | — | — |
| suse | linux_enterprise | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
osv7.5HIGH
vendor_debian7.5HIGH
vendor_redhat7.5HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
CUPS vulnerability
vendor_ubuntu·2009-06-03
CVE-2009-0949 CUPS vulnerability
Title: CUPS vulnerability
Summary: CUPS vulnerability
Anibal Sacco discovered that CUPS did not properly handle certain network
operations. A remote attacker could exploit this flaw and cause the CUPS
server to crash, resulting in a denial of service.
Instructions: In general, a standard system upgrade is sufficient to effect the
necessary changes.
Red Hat
cups: IPP_TAG_UNSUPPORTED handling NULL pointer dereference DoS
vendor_redhat·2009-06-02·CVSS 7.5
CVE-2009-0949 [HIGH] CWE-476 cups: IPP_TAG_UNSUPPORTED handling NULL pointer dereference DoS
cups: IPP_TAG_UNSUPPORTED handling NULL pointer dereference DoS
The ippReadIO function in cups/ipp.c in cupsd in CUPS before 1.3.10 does not properly initialize memory for IPP request packets, which allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a scheduler request with two consecutive IPP_TAG_UNSUPPORTED tags.
Debian
CVE-2009-0949: cups - The ippReadIO function in cups/ipp.c in cupsd in CUPS before 1.3.10 does not pro...
vendor_debian·2009·CVSS 7.5
CVE-2009-0949 [HIGH] CVE-2009-0949: cups - The ippReadIO function in cups/ipp.c in cupsd in CUPS before 1.3.10 does not pro...
The ippReadIO function in cups/ipp.c in cupsd in CUPS before 1.3.10 does not properly initialize memory for IPP request packets, which allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a scheduler request with two consecutive IPP_TAG_UNSUPPORTED tags.
Scope: local
bookworm: resolved (fixed in 1.3.10-1)
bullseye: resolved (fixed in 1.3.10-1)
forky: resolved (fixed in 1.3.10-1)
sid: resolved (fixed in 1.3.10-1)
trixie: resolved (fixed in 1.3.10-1)
GHSA
GHSA-m37g-v637-95q3: The ippReadIO function in cups/ipp
ghsa_unreviewed·2022-05-02
CVE-2009-0949 [MEDIUM] CWE-476 GHSA-m37g-v637-95q3: The ippReadIO function in cups/ipp
The ippReadIO function in cups/ipp.c in cupsd in CUPS before 1.3.10 does not properly initialize memory for IPP request packets, which allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a scheduler request with two consecutive IPP_TAG_UNSUPPORTED tags.
OSV
CVE-2009-0949: The ippReadIO function in cups/ipp
osv·2009-06-09·CVSS 7.5
CVE-2009-0949 [HIGH] CVE-2009-0949: The ippReadIO function in cups/ipp
The ippReadIO function in cups/ipp.c in cupsd in CUPS before 1.3.10 does not properly initialize memory for IPP request packets, which allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a scheduler request with two consecutive IPP_TAG_UNSUPPORTED tags.
No detection rules found.
CWE
Improper Initialization
mitre_cwe
CWE-665 Improper Initialization
CWE-665: Improper Initialization
The product does not initialize or incorrectly initializes a resource, which might leave the resource in an unexpected state when it is accessed or used.
This can have security implications when the associated resource is expected to have certain properties or values, such as a variable that determines whether a user has been authenticated or not.
Modes of Introduction:
Phase: Implementation
Note: This weakness can occur in code paths that are not well-tested, such as rare error conditions. This is because the use of uninitialized data would be noticed as a bug during frequently-used functionality.
Phase: Operation
Common Consequences:
Scope: Confidentiality. Impact: Read Memory, Read Application Data. When reusing a resource such as memory or a program
CWE
Use of Uninitialized Resource
mitre_cwe
CWE-908 Use of Uninitialized Resource
CWE-908: Use of Uninitialized Resource
The product uses or accesses a resource that has not been initialized.
When a resource has not been properly initialized, the product may behave unexpectedly. This may lead to a crash or invalid memory access, but the consequences vary depending on the type of resource and how it is used within the product.
Modes of Introduction:
Phase: Implementation
Common Consequences:
Scope: Confidentiality. Impact: Read Memory, Read Application Data. When reusing a resource such as memory or a program variable, the original contents of that resource may not be cleared before it is sent to an untrusted party.
Scope: Availability. Impact: DoS: Crash, Exit, or Restart. The uninitialized resource may contain values that cause program flow to change in ways that t
CWE
NULL Pointer Dereference
mitre_cwe
CWE-476 NULL Pointer Dereference
CWE-476: NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Modes of Introduction:
Phase: Implementation
Common Consequences:
Scope: Availability. Impact: DoS: Crash, Exit, or Restart. NULL pointer dereferences usually result in the failure of the process unless exception handling (on some platforms) is available and implemented. Even when exception handling is being used, it can still be very difficult to return the software to a safe state of operation.
Scope: Integrity, Confidentiality. Impact: Execute Unauthorized Code or Commands, Read Memory, Modify Memory. In rare circumstances, when NULL is equivalent to the 0x0 memory address and privileged code can access it, then writing or reading memory is possible, which may lead to code ex
http://lists.apple.com/archives/security-announce/2009/Sep/msg00004.htmlhttp://lists.opensuse.org/opensuse-security-announce/2009-07/msg00002.htmlhttp://secunia.com/advisories/35322http://secunia.com/advisories/35328http://secunia.com/advisories/35340http://secunia.com/advisories/35342http://secunia.com/advisories/35685http://secunia.com/advisories/36701http://securitytracker.com/id?1022321http://support.apple.com/kb/HT3865http://www.coresecurity.com/content/AppleCUPS-null-pointer-vulnerabilityhttp://www.debian.org/security/2009/dsa-1811http://www.redhat.com/support/errata/RHSA-2009-1082.htmlhttp://www.redhat.com/support/errata/RHSA-2009-1083.htmlhttp://www.securityfocus.com/archive/1/504032/100/0/threadedhttp://www.securityfocus.com/bid/35169http://www.ubuntu.com/usn/USN-780-1https://bugzilla.redhat.com/show_bug.cgi?id=500972https://exchange.xforce.ibmcloud.com/vulnerabilities/50926https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9631http://lists.apple.com/archives/security-announce/2009/Sep/msg00004.htmlhttp://lists.opensuse.org/opensuse-security-announce/2009-07/msg00002.htmlhttp://secunia.com/advisories/35322http://secunia.com/advisories/35328http://secunia.com/advisories/35340http://secunia.com/advisories/35342http://secunia.com/advisories/35685http://secunia.com/advisories/36701http://securitytracker.com/id?1022321http://support.apple.com/kb/HT3865http://www.coresecurity.com/content/AppleCUPS-null-pointer-vulnerabilityhttp://www.debian.org/security/2009/dsa-1811http://www.redhat.com/support/errata/RHSA-2009-1082.htmlhttp://www.redhat.com/support/errata/RHSA-2009-1083.htmlhttp://www.securityfocus.com/archive/1/504032/100/0/threadedhttp://www.securityfocus.com/bid/35169http://www.ubuntu.com/usn/USN-780-1https://bugzilla.redhat.com/show_bug.cgi?id=500972https://exchange.xforce.ibmcloud.com/vulnerabilities/50926https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9631
2009-06-09
Published