Unscored severity · published Jan 10, 2005
CVE-2004-1270
lppasswd in CUPS 1.1.22, when run in environments that do not ensure that file descriptors 0, 1, and 2 are open when lppasswd is called, does not verify that the passwd.new file…
–
CVSS
0.5%
EPSS
No
On KEV
Description
lppasswd in CUPS 1.1.22, when run in environments that do not ensure that file descriptors 0, 1, and 2 are open when lppasswd is called, does not verify that the passwd.new file is different from STDERR, which allows local users to control output to passwd.new via certain user input that triggers an error message.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 39% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CU
Cups · Easy Software Products
1.0.4; 1.0.4_8; 1.1.1; 1.1.4; 1.1.4_2; 1.1.4_3; +16 more · source: NVD
FC
Fedora Core · Redhat
core_2.0; core_3.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2004-1270
CVE.org
https://www.cve.org/CVERecord?id=CVE-2004-1270
Exploit
http://tigger.uic.edu/~jlongs2/holes/cups2.txt
www.gentoo.org
http://www.gentoo.org/security/en/glsa/glsa-200412-25.xml
www.mandriva.com
http://www.mandriva.com/security/advisories?name=MDKSA-2005:008
www.redhat.com
http://www.redhat.com/support/errata/RHSA-2005-013.html
www.redhat.com
http://www.redhat.com/support/errata/RHSA-2005-053.html
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/18609
More from Cups
–
CVE-2008-1373
Buffer overflow in the gif_read_lzw function in CUPS 1.3.6 allows remote attackers to have an unknown impact via a GIF file with a large code_size value, a similar issue to…
–
CVE-2008-0596
Memory leak in CUPS before 1.1.22, and possibly other versions, allows remote attackers to cause a denial of service (memory consumption and daemon crash) via a large number of…
–
CVE-2008-0597
Use-after-free vulnerability in CUPS before 1.1.22, and possibly other versions, allows remote attackers to cause a denial of service (crash) via crafted IPP packets
–
CVE-2007-5849
Integer underflow in the asn1_get_string function in the SNMP back end (backend/snmp.c) for CUPS 1.2 through 1.3.4 allows remote attackers to execute arbitrary code via a crafted…
–
CVE-2005-3624
The CCITTFaxStream::CCITTFaxStream function in Stream.cc for xpdf, gpdf, kpdf, pdftohtml, poppler, teTeX, CUPS, libextractor, and others allows attackers to corrupt the heap via…