CVE-2014-5030

Published: Jul 29, 2014Modified: May 6, 2026

1.9

Vector

AV:L/AC:M/Au:N/C:P/I:N/A:N

Exploitability: 3.4 / Impact: 2.9

Source: NVD

Description

CUPS before 2.0 allows local users to read arbitrary files via a symlink attack on (1) index.html, (2) index.class, (3) index.pl, (4) index.php, (5) index.pyc, or (6) index.py.

Affected (10)

Products: Canonical: Ubuntu Linux · Apple: Cups

1 product

1 product

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 10.04
Canonical Ubuntu Linux	Version 12.04
Canonical Ubuntu Linux	Version 14.04

Configuration B

7 vulnerable

Vulnerable Software	Affected Versions
Apple Cups	Up to 1.7.4
Apple Cups	Version 1.7.0
Apple Cups	Version 1.7.1
Apple Cups	Version 1.7.1 b1
Apple Cups	Version 1.7.2
Apple Cups	Version 1.7.3
Apple Cups	Version 1.7 rc1

Related CWEs

Improper Link Resolution Before File Access ('Link Following')

The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

References (20)

http://advisories.mageia.org/MGASA-2014-0313.html

Source: security@debian.org

http://rhn.redhat.com/errata/RHSA-2014-1388.html

Source: security@debian.org

http://secunia.com/advisories/60509

Source: security@debian.org

http://secunia.com/advisories/60787

Source: security@debian.org

http://www.debian.org/security/2014/dsa-2990

Source: security@debian.org

http://www.mandriva.com/security/advisories?name=MDVSA-2015:108

Source: security@debian.org

http://www.openwall.com/lists/oss-security/2014/07/22/13

Source: security@debian.org

http://www.openwall.com/lists/oss-security/2014/07/22/2

Source: security@debian.org

http://www.ubuntu.com/usn/USN-2341-1

Source: security@debian.org

https://cups.org/str.php?L4455

Source: security@debian.org

PatchVendor Advisory

http://advisories.mageia.org/MGASA-2014-0313.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://rhn.redhat.com/errata/RHSA-2014-1388.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/60509

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/60787

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.debian.org/security/2014/dsa-2990

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.mandriva.com/security/advisories?name=MDVSA-2015:108

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.openwall.com/lists/oss-security/2014/07/22/13

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.openwall.com/lists/oss-security/2014/07/22/2

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.ubuntu.com/usn/USN-2341-1

Source: af854a3a-2127-422b-91ae-364da2661108

https://cups.org/str.php?L4455

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

Timeline

No history available yet.