CVE-2017-18248 Denial of service in n/a
Remote attackers can crash the CUPS scheduler by sending print jobs with invalid usernames when D-Bus support is enabled.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2017-18248?
CVE-2017-18248 is a medium-severity denial of service vulnerability in Apple Cups, published on 26 Mar 2018. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The add_job function in scheduler/ipp.c in CUPS before 2.2.6, when D-Bus support is enabled, can be crashed by remote attackers by sending print jobs with an invalid username, related to a D-Bus notification.
Weakness: CWE-20
Which versions are affected by CVE-2017-18248?
It affects 1 product.
Products include Apple Cups.
How do I fix CVE-2017-18248?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2017-18248 being exploited?
There is no known exploitation of CVE-2017-18248 in the wild and no public exploit code.
Other vulnerabilities in Apple Cups
Sources
Also known as DEBIAN-CVE-2017-18248, DLA-1387-1, GHSA-445m-qfhv-mv64, MGASA-2018-0224, UBUNTU-CVE-2017-18248.