The session cookie generated by the CUPS web interface was easy to guess on Linux, allowing unauthorized scripted access to the web interface when the web interface is enabled. This issue affected versions prior to v2.2.10.

An update of the cups package has been released.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - cups: code execution via unescape ANSI escape sequences (CVE-2014-8166)

  - In macOS High Sierra before 10.13.5, an issue existed in CUPS. This issue was addressed with improved     access restrictions. (CVE-2018-4180, CVE-2018-4181)

  - The session cookie generated by the CUPS web interface was easy to guess on Linux, allowing unauthorized     scripted access to the web interface when the web interface is enabled. This issue affected versions prior     to v2.2.10. (CVE-2018-4300)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - cups: code execution via unescape ANSI escape sequences (CVE-2014-8166)

  - cups: incorrect string reference counting (VU#810572) (CVE-2015-1158)

  - The web interface for CUPS before 1.3.10 does not validate the HTTP Host header in a client request, which     makes it easier for remote attackers to conduct DNS rebinding attacks. (CVE-2009-0164)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has cups packages installed that are affected by multiple vulnerabilities:

  - In macOS High Sierra before 10.13.5, an issue existed in CUPS. This issue was addressed with improved     access restrictions. (CVE-2018-4180, CVE-2018-4181)

  - The session cookie generated by the CUPS web interface was easy to guess on Linux, allowing unauthorized     scripted access to the web interface when the web interface is enabled. This issue affected versions prior     to v2.2.10. (CVE-2018-4300)

  - ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2018-4300. Reason: This candidate is a     duplicate of CVE-2018-4300. Notes: All CVE users should reference CVE-2018-4300 instead of this candidate.
    All references and descriptions in this candidate have been removed to prevent accidental usage.
    (CVE-2018-4700)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has cups packages installed that are affected by multiple vulnerabilities:

  - In macOS High Sierra before 10.13.5, an issue existed in CUPS. This issue was addressed with improved     access restrictions. (CVE-2018-4180, CVE-2018-4181)

  - The session cookie generated by the CUPS web interface was easy to guess on Linux, allowing unauthorized     scripted access to the web interface when the web interface is enabled. This issue affected versions prior     to v2.2.10. (CVE-2018-4300)

  - ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2018-4300. Reason: This candidate is a     duplicate of CVE-2018-4300. Notes: All CVE users should reference CVE-2018-4300 instead of this candidate.
    All references and descriptions in this candidate have been removed to prevent accidental usage.
    (CVE-2018-4700)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1050 advisory.

  - In macOS High Sierra before 10.13.5, an issue existed in CUPS. This issue was addressed with improved     access restrictions. (CVE-2018-4180, CVE-2018-4181)

  - The session cookie generated by the CUPS web interface was easy to guess on Linux, allowing unauthorized     scripted access to the web interface when the web interface is enabled. This issue affected versions prior     to v2.2.10. (CVE-2018-4300)

  - Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2018-4300. Reason: This candidate is a     duplicate of CVE-2018-4300. Notes: All CVE users should reference CVE-2018-4300 instead of this candidate.
    All references and descriptions in this candidate have been removed to prevent accidental usage     (CVE-2018-4700)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1050 advisory.

  - cups: Local privilege escalation to root due to insecure environment variable handling (CVE-2018-4180)

  - cups: Manipulation of cupsd.conf by a local attacker resulting in limited reads of arbitrary files as root     (CVE-2018-4181)

  - cups: Session cookie generated by the CUPS web interface is easy to guess (CVE-2018-4300)

  - cups: Predictable session cookie breaks CSRF protection (CVE-2018-4700)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An issue has been found in cups, the Common UNIX Printing System(tm).

While generating a session cookie for the CUPS web interface, a predictable random number seed was used. This could lead to unauthorized scripted access to the enabled web interface.

For Debian 8 'Jessie', this problem has been fixed in version 1.7.5-11+deb8u6.

We recommend that you upgrade your cups packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the cups package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability :

  - The session cookie generated by the CUPS web interface     was easy to guess on Linux, allowing unauthorized     scripted access to the web interface when the web     interface is enabled. This issue affected versions     prior to v2.2.10.(CVE-2018-4300)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the cups package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability :

  - The session cookie generated by the CUPS web interface     was easy to guess on Linux, allowing unauthorized     scripted access to the web interface when the web     interface is enabled. This issue affected versions     prior to v2.2.10.(CVE-2018-4300)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the cups packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - CUPS printing system provides a portable printing layer     for UNIXA(r) operating systems. It has been developed by     Apple Inc.to promote a standard printing solution for     all UNIX vendors and users.CUPS provides the System V     and Berkeley command-line interfaces.

  - Security fix(es):

  - The session cookie generated by the CUPS web interface     was easy to guess on Linux, allowing unauthorized     scripted access to the web interface when the web     interface is enabled. (CVE-2018-4300)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
203431	Photon OS 4.0: Cups PHSA-2023-4.0-0329	Nessus	PhotonOS Local Security Checks	medium
198682	RHEL 6 : cups (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
198649	RHEL 5 : cups (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
143972	NewStart CGSL CORE 5.05 / MAIN 5.05 : cups Multiple Vulnerabilities (NS-SA-2020-0102)	Nessus	NewStart CGSL Local Security Checks	high
143926	NewStart CGSL CORE 5.04 / MAIN 5.04 : cups Multiple Vulnerabilities (NS-SA-2020-0067)	Nessus	NewStart CGSL Local Security Checks	high
135325	CentOS 7 : cups (RHSA-2020:1050)	Nessus	CentOS Local Security Checks	high
135077	RHEL 7 : cups (RHSA-2020:1050)	Nessus	Red Hat Local Security Checks	high
129410	Debian DLA-1936-1 : cups security update	Nessus	Debian Local Security Checks	medium
125574	EulerOS Virtualization for ARM 64 3.0.2.0 : cups (EulerOS-SA-2019-1622)	Nessus	Huawei Local Security Checks	medium
125557	EulerOS Virtualization 3.0.1.0 : cups (EulerOS-SA-2019-1605)	Nessus	Huawei Local Security Checks	medium
125495	EulerOS 2.0 SP5 : cups (EulerOS-SA-2019-1568)	Nessus	Huawei Local Security Checks	medium
125494	EulerOS 2.0 SP3 : cups (EulerOS-SA-2019-1567)	Nessus	Huawei Local Security Checks	medium
125493	EulerOS 2.0 SP2 : cups (EulerOS-SA-2019-1566)	Nessus	Huawei Local Security Checks	medium
124730	EulerOS Virtualization 2.5.3 : cups (EulerOS-SA-2019-1352)	Nessus	Huawei Local Security Checks	medium

Detections

Analytics

CVE-2018-4300

medium

Tenable Plugins

medium

high

high

high

high

high

high

medium

medium

medium

medium

medium

medium

medium