CVE - CVE-2009-2820

CVE-ID
CVE-2009-2820	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
The web interface in CUPS before 1.4.2, as used on Apple Mac OS X before 10.6.2 and other platforms, does not properly handle (1) HTTP headers and (2) HTML templates, which allows remote attackers to conduct cross-site scripting (XSS) attacks and HTTP response splitting attacks via vectors related to (a) the product's web interface, (b) the configuration of the print system, and (c) the titles of printed jobs, as demonstrated by an XSS attack that uses the kerberos parameter to the admin program, and leverages attribute injection and HTTP Parameter Pollution (HPP) issues.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
APPLE:APPLE-SA-2009-11-09-1 URL:http://lists.apple.com/archives/security-announce/2009/Nov/msg00000.html BID:36956 URL:http://www.securityfocus.com/bid/36956 CONFIRM:http://support.apple.com/kb/HT3937 CONFIRM:http://www.cups.org/articles.php?L590 CONFIRM:http://www.cups.org/documentation.php/relnotes.html CONFIRM:http://www.cups.org/str.php?L3367 CONFIRM:https://bugzilla.redhat.com/show_bug.cgi?id=529833 MANDRIVA:MDVSA-2010:072 URL:http://www.mandriva.com/security/advisories?name=MDVSA-2010:072 MANDRIVA:MDVSA-2010:073 URL:http://www.mandriva.com/security/advisories?name=MDVSA-2010:073 OVAL:oval:org.mitre.oval:def:9153 URL:https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9153 REDHAT:RHSA-2009:1595 URL:http://www.redhat.com/support/errata/RHSA-2009-1595.html SECUNIA:37308 URL:http://secunia.com/advisories/37308 SECUNIA:37360 URL:http://secunia.com/advisories/37360 SUNALERT:1021115 URL:http://sunsolve.sun.com/search/document.do?assetkey=1-77-1021115.1-1 VUPEN:ADV-2009-3184 URL:http://www.vupen.com/english/advisories/2009/3184
Assigning CNA
MITRE Corporation
Date Record Created
20090817	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20090817)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is a record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)