FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

CVE-2009-0164

This CVE name corresponds to:

Entered	Topic
2009-05-07	cups -- remote code execution and DNS rebinding

The following information is adapted from the Common Vulnerabilities and Exposures (CVE) project. CVE and the CVE logo are trademarks of The MITRE Corporation. CVE content is Copyright 2005, The MITRE Corporation.

CVE-2009-0164 at cve.mitre.org

Details

Type	Candidate
Name	CVE-2009-0164
Phase	Assigned(20090116)

Description

The web interface for CUPS before 1.3.10 does not validate the HTTP Host header in a client request, which makes it easier for remote attackers to conduct DNS rebinding attacks.

References

Source	Reference
BUGTRAQ	20090417 rPSA-2009-0061-1 cups
CONFIRM	http://bugs.gentoo.org/show_bug.cgi?id=263070
CONFIRM	http://www.cups.org/articles.php?L582
CONFIRM	http://www.cups.org/str.php?L3118
CONFIRM	https://bugzilla.redhat.com/show_bug.cgi?id=490597
CONFIRM	http://wiki.rpath.com/Advisories:rPSA-2009-0061
CONFIRM	http://support.apple.com/kb/HT3549
APPLE	APPLE-SA-2009-05-12
GENTOO	GLSA-200904-20
CERT	TA09-133A
BID	34665
SECUNIA	35074
VUPEN	ADV-2009-1297