NVD

Id
13251  
Name
CVE-2010-1748  
Description
The cgi_initialize_string function in cgi-bin/var.c in the web interface in CUPS before 1.4.4, as used on Apple Mac OS X 10.5.8, Mac OS X 10.6 before 10.6.4, and other platforms, does not properly handle parameter values containing a % (percent) character without two subsequent hex characters, which allows context-dependent attackers to obtain sensitive information from cupsd process memory via a crafted request, as demonstrated by the (1) /admin?OP=redirect&URL=% and (2) /admin?URL=/admin/&OP=% URIs.  
Reject
 
CVSS Version
2  
CVSS Score
4.3  
Severity
Medium  
CVSS Base Score
4.3  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:P/I:N/A:N)  
Pub Date
2017-01-18  
Published
2010-06-17  
Modified Date
2013-05-29  
Seq
2010-1748  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
73120 13251 CVE-2010-1748 http://cups.org/articles.php?L596  View
73121 13251 CVE-2010-1748 http://cups.org/str.php?L3577  View
73122 13251 CVE-2010-1748 APPLE-SA-2010-06-15-1  View
73123 13251 CVE-2010-1748 SUSE-SR:2010:023  View
73124 13251 CVE-2010-1748 oval:org.mitre.oval:def:9723  View
73125 13251 CVE-2010-1748 GLSA-201207-10  View
73126 13251 CVE-2010-1748 http://support.apple.com/kb/HT4188  View
73127 13251 CVE-2010-1748 DSA-2176  View
73128 13251 CVE-2010-1748 MDVSA-2010:232  View
73129 13251 CVE-2010-1748 MDVSA-2010:234  View
73130 13251 CVE-2010-1748 40871  View
73131 13251 CVE-2010-1748 ADV-2010-1481  View
73132 13251 CVE-2010-1748 ADV-2011-0535  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
35866 JVNDB-2010-001646 Apple Mac OS X 上で稼働する CUPS における重要な情報を取得される脆弱性 Apple Mac OS X 上で稼働する Web インターフェイスの cgi_initialize_string 関数には、パラメータ値を適切に処理しないため、cupsd プロセスのメモリから重要な情報を取得される脆弱性が存在します。 CVE-2010-1748 44328 CVE-2010-1748 13251 4.3 http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-001646.html 2010-06-15 2011-03-31 View