Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Fri, 21 Nov 2008 08:20:00 +0300
From: Eygene Ryabinkin <>
Cc: "Steven M. Christey" <>,
Subject: Re: CVE request: CUPS DoS via RSS subscriptions

Steve, good day.

Thu, Nov 20, 2008 at 07:41:06PM -0500, Steven M. Christey wrote:
> I treated this as two CVEs, one for the CSRF-simplifying attack, and a
> separate one for the CUPS server crash (assuming that cupsd should not be
> crashable by non-root authenticated users).

Please note that as it was discuissed in thread started with
even 1.3.9 is crashable by non-root authenticated users by adding
a big number of subscriptions (don't know about RSS ones, though
subscription for mailing upon job completion does its job).  But
I imagine that CVE-2008-5184 can't be used for 1.3.9, so remote
attack is not feasible.

I expect that the fix will go into 1.3.10:

Adding Michael Sweet to the CC, since he can shed a bit more light on
this matter.  Perhaps CVE-2008-5183 should be extended or another CVE
can be created.

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.