Vulnerability Name:

CVE-2001-1333 (CCN-9998)

Assigned:2001-05-10
Published:2001-05-10
Updated:2008-09-05
Summary:Linux CUPS before 1.1.6 does not securely handle temporary files, possibly due to a symlink vulnerability that could allow local users to overwrite files.
CVSS v3 Severity:4.0 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L)
Exploitability Metrics:Attack Vector (AV): Local
Attack Complexity (AC): High
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): Low
Availibility (A): Low
CVSS v2 Severity:1.2 Low (CVSS v2 Vector: AV:L/AC:H/Au:N/C:N/I:P/A:N)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): High
Authentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): Partial
Availibility (A): None
2.6 Low (CCN CVSS v2 Vector: AV:L/AC:H/Au:N/C:N/I:P/A:P)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): High
Athentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): Partial
Availibility (A): Partial
Vulnerability Type:CWE-Other
Vulnerability Consequences:File Manipulation
References:Source: MITRE
Type: CNA
CVE-2001-1333

Source: CONECTIVA
Type: UNKNOWN
CLA-2001:384

Source: CONECTIVA
Type: UNKNOWN
CLA-2001:386

Source: CCN
Type: Conectiva Linux Announcement CLSA-2001:384
cups

Source: CCN
Type: Conectiva Linux Announcement CLSA-2001:386
Several vulnerabilities in the cups package - NEW RELEASE

Source: SUSE
Type: Patch, Vendor Advisory
SuSE-SA:2002:005

Source: CCN
Type: RHSA-2002-032
Updated cups packages are available

Source: CCN
Type: CUPS Web site
Release Notes - Common UNIX Printing System

Source: MANDRAKE
Type: Patch, Vendor Advisory
MDKSA-2001:048

Source: CCN
Type: OSVDB ID: 10738
CUPS Insecure Temporary File Handling

Source: CCN
Type: OSVDB ID: 50637
CUPS pstopdf /tmp/pstopdf.log Temporary File Symlink Arbitrary File Overwrite

Source: CCN
Type: SuSE Security Announcement SuSE-SA:2001:05
cups

Source: XF
Type: UNKNOWN
cups-tmpfile-symlink(9998)

Vulnerable Configuration:Configuration 1:
  • cpe:/a:easy_software_products:cups:*:*:*:*:*:*:*:* (Version <= 1.1.5)

    • Configuration CCN 1:
  • cpe:/o:mandrakesoft:mandrake_linux:7.2:*:*:*:*:*:*:*
  • OR cpe:/o:conectiva:linux:6.0:*:*:*:*:*:*:*
  • OR cpe:/o:suse:suse_linux:7.1:*:*:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:8.0:*:*:*:*:*:*:*
  • OR cpe:/a:redhat:linux_powertools:7.0:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    BACK
    easy_software_products cups *
    mandrakesoft mandrake linux 7.2
    conectiva linux 6.0
    suse suse linux 7.1
    mandrakesoft mandrake linux 8.0
    redhat linux powertools 7.0