Description
Cross-site request forgery (CSRF) vulnerability in the web interface in CUPS before 1.4.4, as used on Apple Mac OS X 10.5.8, Mac OS X 10.6 before 10.6.4, and other platforms, allows remote attackers to hijack the authentication of administrators for requests that change settings.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
n/a n/a
n/aaffected
References
- http://lists.apple.com/archives/security-announce/2010//Jun/msg00001.html ↗
- http://www.mandriva.com/security/advisories?name=MDVSA-2010:234 ↗
- http://www.vupen.com/english/advisories/2010/1481 ↗
- http://cups.org/articles.php?L596 ↗
- http://www.securityfocus.com/bid/40871 ↗
- http://www.mandriva.com/security/advisories?name=MDVSA-2010:232 ↗
- http://www.debian.org/security/2011/dsa-2176 ↗
- http://support.apple.com/kb/HT4188 ↗
- http://security.gentoo.org/glsa/glsa-201207-10.xml ↗
- http://www.vupen.com/english/advisories/2011/0535 ↗
- http://secunia.com/advisories/40220 ↗
- http://cups.org/str.php?L3498 ↗
- http://www.mandriva.com/security/advisories?name=MDVSA-2010:233 ↗
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10382 ↗
- http://secunia.com/advisories/43521 ↗
- http://www.securitytracker.com/id?1024122 ↗