Bug 3579 - Security Advisory - cups - CVE-2012-5519
Summary: Security Advisory - cups - CVE-2012-5519
Status: RESOLVED FIXED
Alias: None
Product: OE-Core
Classification: Build System, Metadata & Runtime
Component: core (show other bugs)
Version: 1.4
Hardware: x86 Multiple
: Medium normal
Target Milestone: Future
Assignee: Li Wang
QA Contact:
URL:
Whiteboard: P3
Depends on:
Blocks:
 
Reported: 2012-12-13 04:14 UTC by Li Wang
Modified: 2013-03-01 11:03 UTC (History)
8 users (show)

See Also:
OS type for building Yocto: ---
Type of Regression: ---
Verified:
Documentation change: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Li Wang 2012-12-13 04:14:41 UTC 
CUPS 1.4.4, when running in certain Linux distributions such as Debian GNU/Linux, stores the web interface administrator key in /var/run/cups/certs/0 using certain permissions, which allows local users in the lpadmin group to read or write arbitrary files as root by leveraging the web interface.

http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-5519
Comment 1 Ross Burton 2013-03-01 11:03:34 UTC 
This has been integrated into master and will be in 1.3.1.