CVE-2012-6094 Missing authorization in cups

Critical 9.8 Published 20 Dec 2019 Updated 6 Aug 2024

CUPS fails to enforce localhost-only listening restrictions, allowing unauthorized remote access to the printing service.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2012-6094?

CVE-2012-6094 is a critical missing authorization vulnerability in Apple Cups, published on 20 Dec 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

cups (Common Unix Printing System) 'Listen localhost:631' option not honored correctly which could provide unauthorized access to the system

Weakness: CWE-863

Which versions are affected by CVE-2012-6094?

It affects 2 products.

Products include Apple Cups, Debian Debian Linux.

How do I fix CVE-2012-6094?

Apply the vendor's patch.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2012-6094 being exploited?

There is no known exploitation of CVE-2012-6094 in the wild and no public exploit code.

All Apple Cups vulnerabilities

Sources

Also known as GHSA-h5wh-487c-mrjg.