According to the versions of the cups packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - CUPS printing system provides a portable printing layer     for UNIXA(r) operating systems. It has been developed by     Apple Inc.to promote a standard printing solution for     all UNIX vendors and users.CUPS provides the System V     and Berkeley command-line interfaces.

  - Security fix(es):

  - The session cookie generated by the CUPS web interface     was easy to guess on Linux, allowing unauthorized     scripted access to the web interface when the web     interface is enabled. (CVE-2018-4300)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The session cookie generated by the CUPS web interface was easy to guess on Linux, allowing unauthorized     scripted access to the web interface when the web interface is enabled. This issue affected versions prior     to v2.2.10. (CVE-2018-4300)

Note that Nessus relies on the presence of the package as reported by the vendor.

According to the version of the cups package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability :

  - The session cookie generated by the CUPS web interface     was easy to guess on Linux, allowing unauthorized     scripted access to the web interface when the web     interface is enabled. This issue affected versions     prior to v2.2.10.(CVE-2018-4300)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update of the cups package has been released.

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has cups packages installed that are affected by multiple vulnerabilities:

  - In macOS High Sierra before 10.13.5, an issue existed in CUPS. This issue was addressed with improved     access restrictions. (CVE-2018-4180, CVE-2018-4181)

  - The session cookie generated by the CUPS web interface was easy to guess on Linux, allowing unauthorized     scripted access to the web interface when the web interface is enabled. This issue affected versions prior     to v2.2.10. (CVE-2018-4300)

  - ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2018-4300. Reason: This candidate is a     duplicate of CVE-2018-4300. Notes: All CVE users should reference CVE-2018-4300 instead of this candidate.
    All references and descriptions in this candidate have been removed to prevent accidental usage.
    (CVE-2018-4700)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An issue has been found in cups, the Common UNIX Printing System(tm).

While generating a session cookie for the CUPS web interface, a predictable random number seed was used. This could lead to unauthorized scripted access to the enabled web interface.

For Debian 8 'Jessie', this problem has been fixed in version 1.7.5-11+deb8u6.

We recommend that you upgrade your cups packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has cups packages installed that are affected by multiple vulnerabilities:

  - In macOS High Sierra before 10.13.5, an issue existed in CUPS. This issue was addressed with improved     access restrictions. (CVE-2018-4180, CVE-2018-4181)

  - The session cookie generated by the CUPS web interface was easy to guess on Linux, allowing unauthorized     scripted access to the web interface when the web interface is enabled. This issue affected versions prior     to v2.2.10. (CVE-2018-4300)

  - ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2018-4300. Reason: This candidate is a     duplicate of CVE-2018-4300. Notes: All CVE users should reference CVE-2018-4300 instead of this candidate.
    All references and descriptions in this candidate have been removed to prevent accidental usage.
    (CVE-2018-4700)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1050 advisory.

  - In macOS High Sierra before 10.13.5, an issue existed in CUPS. This issue was addressed with improved     access restrictions. (CVE-2018-4180, CVE-2018-4181)

  - The session cookie generated by the CUPS web interface was easy to guess on Linux, allowing unauthorized     scripted access to the web interface when the web interface is enabled. This issue affected versions prior     to v2.2.10. (CVE-2018-4300)

  - Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2018-4300. Reason: This candidate is a     duplicate of CVE-2018-4300. Notes: All CVE users should reference CVE-2018-4300 instead of this candidate.
    All references and descriptions in this candidate have been removed to prevent accidental usage     (CVE-2018-4700)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the version of the cups package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability :

  - The session cookie generated by the CUPS web interface     was easy to guess on Linux, allowing unauthorized     scripted access to the web interface when the web     interface is enabled. This issue affected versions     prior to v2.2.10.(CVE-2018-4300)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1050 advisory.

    The Common UNIX Printing System (CUPS) provides a portable printing layer for Linux, UNIX, and similar     operating systems.

    Security Fix(es):

    * cups: Local privilege escalation to root due to insecure environment variable handling (CVE-2018-4180)

    * cups: Manipulation of cupsd.conf by a local attacker resulting in limited reads of arbitrary files as     root (CVE-2018-4181)

    * cups: Predictable session cookie breaks CSRF protection (CVE-2018-4700)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.8 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
125495	EulerOS 2.0 SP5 : cups (EulerOS-SA-2019-1568)	Nessus	Huawei Local Security Checks	5/29/2019	2/28/2025	medium
221836	Linux Distros Unpatched Vulnerability : CVE-2018-4300	Nessus	Misc.	3/4/2025	3/4/2025	medium
125557	EulerOS Virtualization 3.0.1.0 : cups (EulerOS-SA-2019-1605)	Nessus	Huawei Local Security Checks	5/30/2019	2/28/2025	medium
203431	Photon OS 4.0: Cups PHSA-2023-4.0-0329	Nessus	PhotonOS Local Security Checks	7/23/2024	7/23/2024	medium
143972	NewStart CGSL CORE 5.05 / MAIN 5.05 : cups Multiple Vulnerabilities (NS-SA-2020-0102)	Nessus	NewStart CGSL Local Security Checks	12/9/2020	5/11/2022	high
125493	EulerOS 2.0 SP2 : cups (EulerOS-SA-2019-1566)	Nessus	Huawei Local Security Checks	5/29/2019	2/28/2025	medium
129410	Debian DLA-1936-1 : cups security update	Nessus	Debian Local Security Checks	9/30/2019	2/24/2025	medium
125494	EulerOS 2.0 SP3 : cups (EulerOS-SA-2019-1567)	Nessus	Huawei Local Security Checks	5/29/2019	2/28/2025	medium
143926	NewStart CGSL CORE 5.04 / MAIN 5.04 : cups Multiple Vulnerabilities (NS-SA-2020-0067)	Nessus	NewStart CGSL Local Security Checks	12/9/2020	5/11/2022	high
135325	CentOS 7 : cups (RHSA-2020:1050)	Nessus	CentOS Local Security Checks	4/10/2020	10/9/2024	high
125574	EulerOS Virtualization for ARM 64 3.0.2.0 : cups (EulerOS-SA-2019-1622)	Nessus	Huawei Local Security Checks	5/30/2019	2/28/2025	medium
135077	RHEL 7 : cups (RHSA-2020:1050)	Nessus	Red Hat Local Security Checks	4/1/2020	11/7/2024	high
124730	EulerOS Virtualization 2.5.3 : cups (EulerOS-SA-2019-1352)	Nessus	Huawei Local Security Checks	5/10/2019	3/20/2025	medium

Detections

Analytics

Plugins Search

medium

medium

medium

medium

high

medium

medium

medium

high

high

medium

high

medium