The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The web interface for CUPS before 1.3.10 does not validate the HTTP Host header in a client request, which     makes it easier for remote attackers to conduct DNS rebinding attacks. (CVE-2009-0164)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote host is affected by the vulnerability described in GLSA-200904-20 (CUPS: Multiple vulnerabilities)

    The following issues were reported in CUPS:
    iDefense     reported an integer overflow in the _cupsImageReadTIFF() function in     the 'imagetops' filter, leading to a heap-based buffer overflow     (CVE-2009-0163).
    Aaron Siegel of Apple Product Security     reported that the CUPS web interface does not verify the content of the     'Host' HTTP header properly (CVE-2009-0164).
    Braden Thomas and     Drew Yao of Apple Product Security reported that CUPS is vulnerable to     CVE-2009-0146, CVE-2009-0147 and CVE-2009-0166, found earlier in xpdf     and poppler.
  Impact :

    A remote attacker might send or entice a user to send a specially     crafted print job to CUPS, possibly resulting in the execution of     arbitrary code with the privileges of the configured CUPS user -- by     default this is 'lp', or a Denial of Service. Furthermore, the web     interface could be used to conduct DNS rebinding attacks.
  Workaround :

    There is no known workaround at this time.

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - 1.3.10 以前の CUPS の Web インターフェイスは、クライアントリクエストの HTTP Host ヘッダーを検証しません。これにより、リモートの攻撃者が DNS リバインド攻撃を実行しやすくなります。 （CVE-2009-0164）

Nessus は、ベンダーによって報告されたパッケージの存在に依存していることに注意してください。

バナーによると、リモートホストにインストールされている CUPSのバージョンは 1.3.10 以前です。このようなバージョンは、以下の複数の問題の影響を受けます：

  -「_cupsImageReadPNG（）」のPNG画像検証コードにおける潜在的な整数オーバーフローにより、影響を受けるサービスを攻撃者がクラッシュさせたり、任意のコードを実行したりする可能性があります。（STR #2974）

  - 特別に細工されたTIFFファイルの画像の高さを適切に検証できないため、「_ cupsImageReadTIFF（）」にヒープベースの整数オーバーフローが存在します。これを利用して、任意のコードが実行される可能性があります。
    （STR #3031）

  - 受信リクエストにおけるHTTP Hostヘッダーを検証できないため、WebインターフェイスがDNS再バインド攻撃に脆弱な可能性があります。（STR #3118）

  - pdftopsでのヒープベースのバッファオーバーフローにより、リモート攻撃者は、細工されたJBIG2シンボル辞書セグメントを使って、PDFファイルを介して任意のコードを実行できます。
    （CVE-2009-0195）

  - 「ippReadIO（）」関数における欠陥のある「ip」構造の初期化により、匿名のリモート攻撃者が、2つの連続したIPP_TAG_UNSUPPORTEDタグを持つ悪意のあるIPPリクエストパケットを通じて、アプリケーションをクラッシュさせる可能性があります。
    （CVE-2009-0949）

根据其标题，远程主机上安装的 CUPS 版本低于 1.3.10。此类版本受到多个问题的影响：

  - “_cupsImageReadPNG()”中 PNG 图像验证代码中潜在的整数溢出漏洞允许攻击者导致受影响的服务崩溃或可能执行任意代码。(STR #2974)

  - “_cupsImageReadTIFF()”中存在一个基于堆的整数溢出漏洞，这是未能正确验证特别构建的 TIFF 文件的图像高度所致，该漏洞可被用来执行任意代码。
    (STR #3031)

  - 由于无法验证传入请求中的 HTTP 主机标头，Web 接口可能容易遭受 DNS 重新绑定攻击。(STR #3118)

  - pdftops 中基于堆的缓冲区溢出漏洞允许远程攻击者通过包含构建的 JBIG2 符号字典段的 PDF 文件执行任意代码。
    (CVE-2009-0195)

  - 函数“ippReadIO()”中有缺陷的“ip”结构初始化允许匿名远程攻击者通过具有两个连续 IPP_TAG_UNSUPPORTED 标签的恶意 IPP 请求数据包来造成应用程序崩溃。
    (CVE-2009-0949)

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - 低于 1.3.10 的 CUPS 的 Web 界面不会验证客户端请求中的 HTTP Host 标头，这会使远程攻击者更容易发动 DNS 重新绑定攻击。 (CVE-2009-0164)

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

根據其標題，遠端主機上安裝的 CUPS 版本比 1.3.10 舊。這些版本受到多個問題影響：

  -「_cupsImageReadPNG()」的 PNG 影像驗證碼中有一個潛在的整數溢位問題，允許攻擊者損毀受影響的服務或可能執行任意程式碼。(STR #2974)

  -「_cupsImageReadTIFF()」中有一個堆積型整數溢位問題，這是應用程式無法正確驗證特製 TIFF 檔案的影像高度所導致，攻擊者可利用此問題執行任意程式碼。
    (STR #3031)

  - Web 介面可能容易遭受 DNS 重新繫結攻擊，這是應用程式無法驗證傳入要求中的 HTTP Host 標頭所導致。(STR #3118)

  - pdftops 中有一個堆積型緩衝區溢位弱點，遠端攻擊者可利用此弱點，藉由包含特製的 JBIG2 符號字典區段的 PDF 檔案來執行任意程式碼。
    (CVE-2009-0195)

  - 「ippReadIO()」函式中的「ip」結構初始化存在瑕疵，匿名的遠端攻擊者可以利用此瑕疵，透過具有兩個連續 IPP_TAG_UNSUPPORTED 標籤的惡意 IPP 要求封包造成應用程式損毀。
    (CVE-2009-0949)

Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且供應商未提供可用的修補程式。

  - 1.3.10 之前的 CUPS Web 介面未驗證用戶端要求中的 HTTP Host 標頭，這會讓遠端攻擊者更容易發動 DNS 重新系結攻擊。 (CVE-2009-0164)

請注意，Nessus 依賴供應商報告的套件存在。

This update fixes several security issues: CVE-2009-0163, CVE-2009-0164, CVE-2009-0146, CVE-2009-0147, and CVE-2009-0166. PDF files are now converted to PostScript using the poppler package's 'pdftops' program. NOTE: If your CUPS server is accessed using a hostname or hostnames not known to the server itself you must add 'ServerAlias hostname' to cupsd.conf for each such name. The special line 'ServerAlias *' disables checking (but this allows DNS rebinding attacks).

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its banner, the version of CUPS installed on the remote host is earlier than 1.3.10. Such versions are affected by several issues :

  - A potential integer overflow in the PNG image validation     code in '_cupsImageReadPNG()' could allow an attacker to     crash the affected service or possibly execute arbitrary     code. (STR #2974)

  - A heap-based integer overflow exists in     '_cupsImageReadTIFF()' due to a failure to properly     validate the image height of a specially crafted TIFF     file, which can be leveraged to execute arbitrary code.
    (STR #3031)

  - The web interface may be vulnerable to DNS rebinding     attacks due to a failure to validate the HTTP Host     header in incoming requests. (STR #3118)

  - A heap-based buffer overflow in pdftops allows remote     attackers to execute arbitrary code via a PDF file with     crafted JBIG2 symbol dictionary segments.
    (CVE-2009-0195)

  - Flawed 'ip' structure initialization in the function     'ippReadIO()' could allow an anonymous remote attacker     to crash the application via a malicious IPP request     packet with two consecutives IPP_TAG_UNSUPPORTED tags.
    (CVE-2009-0949)

Gentoo security team summarizes :

The following issues were reported in CUPS :

- iDefense reported an integer overflow in the _cupsImageReadTIFF() function in the 'imagetops' filter, leading to a heap-based buffer overflow (CVE-2009-0163).

- Aaron Siegel of Apple Product Security reported that the CUPS web interface does not verify the content of the 'Host' HTTP header properly (CVE-2009-0164).

- Braden Thomas and Drew Yao of Apple Product Security reported that CUPS is vulnerable to CVE-2009-0146, CVE-2009-0147 and CVE-2009-0166, found earlier in xpdf and poppler.

A remote attacker might send or entice a user to send a specially crafted print job to CUPS, possibly resulting in the execution of arbitrary code with the privileges of the configured CUPS user -- by default this is 'lp', or a Denial of Service. Furthermore, the web interface could be used to conduct DNS rebinding attacks.

New cups packages are available for Slackware 12.0, 12.1, 12.2, and
-current to fix security issues.

The remote host is running a version of Mac OS X 10.4 that does not have Security Update 2009-002 applied.

This security update contains fixes for the following products :

  - Apache
  - ATS
  - BIND
  - CoreGraphics
  - Cscope
  - CUPS
  - Disk Images
  - enscript
  - Flash Player plug-in
  - Help Viewer
  - IPSec
  - Kerberos
  - Launch Services
  - libxml
  - Net-SNMP
  - Network Time
  - OpenSSL
  - QuickDraw Manager
  - Spotlight
  - system_cmds
  - telnet
  - Terminal
  - X11

The remote host is running a version of Mac OS X 10.5.x that is prior to 10.5.7. 

Mac OS X 10.5.7 contains security fixes for the following products :

  - Apache
  - ATS
  - BIND
  - CFNetwork
  - CoreGraphics
  - Cscope
  - CUPS
  - Disk Images
  - enscript
  - Flash Player plug-in
  - Help Viewer
  - iChat
  - International Components for Unicode
  - IPSec
  - Kerberos
  - Kernel
  - Launch Services
  - libxml
  - Net-SNMP
  - Network Time
  - Networking
  - OpenSSL
  - PHP
  - QuickDraw Manager
  - ruby
  - Safari
  - Spotlight
  - system_cmds
  - telnet
  - Terminal
  - WebKit
  - X11

According to its banner, the version of CUPS installed on the remote host is earlier than 1.3.10.  Such versions are affected by multiple integer overflow vulnerabilities : 

  - A potential integer overflow in the PNG image validation code in '_cupsImageReadPNG()'. (STR #2974)

  - A heap-based integer overflow in '_cupsImageReadTIFF()'. (STR #3031)

  - The web interface may be vulnerable to DNS rebinding attacks due to a failure to validate the HTTP Host header in incoming requests. (STR #3118)

  - A heap-based buffer overflow in pdftops. (CVE-2009-0195)

  - Flawed 'ip' structure initialization in the function 'ippReadIO()' could allow an attacker to crash the application.

The remote host is running a version of Mac OS X 10.5 that is older than version 10.5.7.  Mac OS X 10.5.7 contains security fixes for the following products : 

- Apache
- ATS
- BIND
- CFNetwork
- CoreGraphics
-Cscope
- CUPS
- Disk Images
- enscript
- Flash player
- Help Viewer
- iChat
- Internation Components for Unicode
- IPSec
- Kerberos
- Kernel
- Launch Services
- libxml
- Net-SNMP
- Network Time
- Networking
- OpenSSL
- PHP
- QuickDraw Manager
- ruby
- Safari
- Spotlight
- system_cmds
- telnet
- WebKit
- X11
- Terminal

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
217086	Linux Distros Unpatched Vulnerability : CVE-2009-0164	Nessus	Misc.	2025/3/3	2025/3/3	critical
38161	GLSA-200904-20 : CUPS: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2009/4/27	2021/1/6	medium
217086	Linux Distros のパッチ未適用の脆弱性: CVE-2009-0164	Nessus	Misc.	2025/3/3	2025/3/3	critical
36183	CUPS < 1.3.10 複数の脆弱性	Nessus	Misc.	2009/4/17	2018/11/15	high
36183	CUPS < 1.3.10 多种漏洞	Nessus	Misc.	2009/4/17	2018/11/15	high
217086	Linux Distros 未修补的漏洞: CVE-2009-0164	Nessus	Misc.	2025/3/3	2025/3/3	critical
36183	CUPS < 1.3.10 多個弱點	Nessus	Misc.	2009/4/17	2018/11/15	high
217086	Linux Distros 未修補弱點：CVE-2009-0164	Nessus	Misc.	2025/3/3	2025/3/3	critical
36209	Fedora 9 : cups-1.3.10-1.fc9 (2009-3753)	Nessus	Fedora Local Security Checks	2009/4/22	2021/1/11	medium
36183	CUPS < 1.3.10 Multiple Vulnerabilities	Nessus	Misc.	2009/4/17	2018/11/15	high
38705	FreeBSD : cups -- remote code execution and DNS rebinding (736e55bc-39bb-11de-a493-001b77d09812)	Nessus	FreeBSD Local Security Checks	2009/5/8	2021/1/6	medium
37075	Fedora 10 : cups-1.3.10-1.fc10 (2009-3769)	Nessus	Fedora Local Security Checks	2009/4/23	2021/1/11	medium
38166	Slackware 12.0 / 12.1 / 12.2 / current : cups (SSA:2009-116-01)	Nessus	Slackware Local Security Checks	2009/4/27	2021/1/14	medium
38743	Mac OS X Multiple Vulnerabilities (Security Update 2009-002)	Nessus	MacOS X Local Security Checks	2009/5/13	2024/5/28	critical
38744	Mac OS X 10.5.x < 10.5.7 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	2009/5/13	2024/5/28	critical
4771	CUPS < 1.3.10 Multiple Overflows	Nessus Network Monitor	Web Servers	2008/12/1	2019/3/6	high
5023	Mac OS X 10.5 < 10.5.7 Multiple Vulnerabilities	Nessus Network Monitor	Generic	2004/8/18	2019/3/6	critical
800792	Mac OS X 10.5 < 10.5.7 Multiple Vulnerabilities	Log Correlation Engine	Operating System Detection			high

检测

插件搜索

critical

medium

critical

high

high

critical

high

critical

medium

high

medium

medium

medium

critical

critical

high

critical

high