Vulnerability Details : CVE-2014-3537
The web interface in CUPS before 1.7.4 allows local users in the lp group to read arbitrary files via a symlink attack on a file in /var/cache/cups/rss/.
Products affected by CVE-2014-3537
- cpe:2.3:a:apple:cups:*:*:*:*:*:*:*:*
- cpe:2.3:a:apple:cups:1.7:rc1:*:*:*:*:*:*
- cpe:2.3:a:apple:cups:1.7.1:b1:*:*:*:*:*:*
- cpe:2.3:a:apple:cups:1.7.0:*:*:*:*:*:*:*
- cpe:2.3:a:apple:cups:1.7.2:*:*:*:*:*:*:*
- cpe:2.3:a:apple:cups:1.7.1:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:12.04:-:lts:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:10.04:-:lts:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:20:*:*:*:*:*:*:*
Threat overview for CVE-2014-3537
Top countries where our scanners detected CVE-2014-3537
Top open port discovered on systems with this issue
631
IPs affected by CVE-2014-3537 28,623
Threat actors abusing to this issue?
Yes
Find out if you* are
affected by CVE-2014-3537!
*Directly or indirectly through your vendors, service providers and 3rd parties.
Powered by
attack surface intelligence
from SecurityScorecard.
Exploit prediction scoring system (EPSS) score for CVE-2014-3537
0.06%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 25 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2014-3537
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
1.2
|
LOW | AV:L/AC:H/Au:N/C:P/I:N/A:N |
1.9
|
2.9
|
NIST |
CWE ids for CVE-2014-3537
-
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.Assigned by: nvd@nist.gov (Primary)
References for CVE-2014-3537
-
https://bugzilla.redhat.com/show_bug.cgi?id=1115576
1115576 – (CVE-2014-3537) CVE-2014-3537 cups: insufficient checking leads to privilege escalation
-
http://secunia.com/advisories/60273
Sign in
-
http://www.cups.org/blog.php?L724
CUPS 1.7.4 - CUPS.orgVendor Advisory
-
http://secunia.com/advisories/60787
Sign in
-
http://lists.fedoraproject.org/pipermail/package-announce/2014-July/135528.html
[SECURITY] Fedora 20 Update: cups-1.7.4-1.fc20
-
http://www.securityfocus.com/bid/68788
CUPS Web Interface CVE-2014-3537 Local Privilege Escalation VulnerabilityVendor Advisory
-
https://support.apple.com/kb/HT6535
About the security content of OS X Yosemite v10.10 - Apple Support
-
http://rhn.redhat.com/errata/RHSA-2014-1388.html
RHSA-2014:1388 - Security Advisory - Red Hat Customer Portal
-
http://www.securitytracker.com/id/1030611
CUPS RSS Web Interface Lets Local Users View Privileged Files - SecurityTracker
-
http://www.cups.org/str.php?L4450
CVE-2014-3537: Insufficient checking leads to privilege escalation · Issue #4450 · apple/cups · GitHub
-
http://www.mandriva.com/security/advisories?name=MDVSA-2015:108
mandriva.com
-
http://www.ubuntu.com/usn/USN-2293-1
USN-2293-1: CUPS vulnerability | Ubuntu security notices
-
http://advisories.mageia.org/MGASA-2014-0313.html
Mageia Advisory: MGASA-2014-0313 - Updated cups packages fix security vulnerability
-
http://archives.neohapsis.com/archives/bugtraq/2014-10/0101.html
Jump to