CVE-2017-18190 Auth bypass in n/a
Remote attackers can execute arbitrary IPP commands via DNS rebinding due to a flawed localhost whitelist, potentially leading to code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2017-18190?
CVE-2017-18190 is a high-severity authentication bypass vulnerability in Apple Cups, published on 16 Feb 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A localhost.localdomain whitelist entry in valid_host() in scheduler/client.c in CUPS before 2.2.2 allows remote attackers to execute arbitrary IPP commands by sending POST requests to the CUPS daemon in conjunction with DNS rebinding. The localhost.localdomain name is often resolved via a DNS server (neither the OS nor the web browser is responsible for ensuring that localhost.localdomain is 127.0.0.1).
Weakness: CWE-290
Which versions are affected by CVE-2017-18190?
It affects 3 products.
Linux distribution packages (13)
cups SUSE:Linux Enterprise Desktop 12 SP2 | All versions | 1.7.5-20.3.1 |
cups SUSE:Linux Enterprise Desktop 12 SP3 | All versions | 1.7.5-20.3.1 |
cups SUSE:Linux Enterprise Server 12 SP1-LTSS | All versions | 1.7.5-20.3.1 |
cups SUSE:Linux Enterprise Server 12 SP2 | All versions | 1.7.5-20.3.1 |
cups SUSE:Linux Enterprise Server 12 SP3 | All versions | 1.7.5-20.3.1 |
cups SUSE:Linux Enterprise Server 12-LTSS | All versions | 1.7.5-20.3.1 |
cups SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2 | All versions | 1.7.5-20.3.1 |
cups SUSE:Linux Enterprise Server for SAP Applications 12 SP1 | All versions | 1.7.5-20.3.1 |
cups SUSE:Linux Enterprise Server for SAP Applications 12 SP2 | All versions | 1.7.5-20.3.1 |
cups SUSE:Linux Enterprise Server for SAP Applications 12 SP3 | All versions | 1.7.5-20.3.1 |
cups SUSE:Linux Enterprise Software Development Kit 12 SP2 | All versions | 1.7.5-20.3.1 |
cups SUSE:Linux Enterprise Software Development Kit 12 SP3 | All versions | 1.7.5-20.3.1 |
cups SUSE:OpenStack Cloud 6 | All versions | 1.7.5-20.3.1 |
Products include Apple Cups, Canonical Ubuntu Linux, Debian Debian Linux.
How do I fix CVE-2017-18190?
Upgrade to a fixed version.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2017-18190 being exploited?
There is no known exploitation of CVE-2017-18190 in the wild and no public exploit code.
Other vulnerabilities in Apple Cups
Sources
Also known as ALPINE-CVE-2017-18190, DEBIAN-CVE-2017-18190, DLA-1288-1, GHSA-vfqc-qhm9-65mm, MGASA-2018-0147, SUSE-SU-2018:0604-1 and 2 more.