Sign-up

ID

VAR-201901-1019


CVE

CVE-2018-4182


TITLE

macOS High Sierra Access vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2018-013601

DESCRIPTION

In macOS High Sierra before 10.13.5, an access issue was addressed with additional sandbox restrictions on CUPS. macOS High Sierra Contains an access vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Apple macOS High Sierra is a set of dedicated operating systems developed by Apple (Apple) for Mac computers. CUPS is one of the open source printing system components for OS X and Unix-like systems. An attacker could exploit this vulnerability to bypass sandbox restrictions. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 - ------------------------------------------------------------------------- Debian Security Advisory DSA-4243-1 security@debian.org https://www.debian.org/security/ Luciano Bello July 11, 2018 https://www.debian.org/security/faq - ------------------------------------------------------------------------- Package : cups CVE ID : CVE-2017-15400 CVE-2018-4180 CVE-2018-4181 CVE-2018-4182 CVE-2018-4183 CVE-2018-6553 Several vulnerabilities were discovered in CUPS, the Common UNIX Printing System. These issues have been identified with the following CVE ids: CVE-2017-15400 Rory McNamara discovered that an attacker is able to execute arbitrary commands (with the privilege of the CUPS daemon) by setting a malicious IPP server with a crafted PPD file. CVE-2018-4180 Dan Bastone of Gotham Digital Science discovered that a local attacker with access to cupsctl could escalate privileges by setting an environment variable. CVE-2018-4181 Eric Rafaloff and John Dunlap of Gotham Digital Science discovered that a local attacker can perform limited reads of arbitrary files as root by manipulating cupsd.conf. CVE-2018-4182 Dan Bastone of Gotham Digital Science discovered that an attacker with sandboxed root access can execute backends without a sandbox profile by provoking an error in CUPS' profile creation. CVE-2018-4183 Dan Bastone and Eric Rafaloff of Gotham Digital Science discovered that an attacker with sandboxed root access can execute arbitrary commands as unsandboxed root by modifying /etc/cups/cups-files.conf CVE-2018-6553 Dan Bastone of Gotham Digital Science discovered that an attacker can bypass the AppArmor cupsd sandbox by invoking the dnssd backend using an alternate name that has been hard linked to dnssd. For the stable distribution (stretch), these problems have been fixed in version 2.2.1-8+deb9u2. We recommend that you upgrade your cups packages. For the detailed security status of cups please refer to its security tracker page at: https://security-tracker.debian.org/tracker/cups Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEayzFlnvRveqeWJspbsLe9o/+N3QFAltGE+0ACgkQbsLe9o/+ N3RzTBAAog31K8+nfhrds2NQZeWaz0rGevs6hHj5wuf40FemG0IoHYfl7xba66Fx gVTZSDbpOuFnG1YQet0UpfsXsogTuaPv6/qP89YASEM8ncLSgBUTKS1bK7VM6SyP NZCWUmjmfsyf0yv7tvnWnq0k5I6MwHRRX6l0fI+treXz0nwjXDIPnKH1Xbv4zW1Y TTpmxD4FknyzkXJGxJoBwMcclPGCkT6W1IrBPQrjscUJvFBWiNW3umAoiuv+aCCr sM+raoK0SJTLFJ289AhrXajKilt0SfTHly12mpxUKnyevPCAz5o+nbtQMhQrALLQ foRuTAfI3WhubZFd7bTUjhrVo1nhS4khnmriyRxsCL7o19dc5rfQd1fO1IvCDQCb YtnWhDD7Tfzspetpr5kUk/pbB1U//uyWDFji73ZURFPbn5Pa+Z80OUGIRd9IIlNg ODJsNq5X/bjwoJgwJwi3W6SieyNWKBaTR5Ktk2iqBOJQ++KqV3BmsCVI/B/5NFnV /heBZYugaknsmdQVbdKa9jv3GIr4TE4frqJJrAsZ0KGnlKNNzoe3pQIk6nA0f/4d z3JalPDGwfL+Qq2AAJlqx2346ro0bViHUAGXJc1zsx44LHBVaRotV+a0gTXsh3z/ 3tQIHs2KZ4KRzczK7pbDDbeSEsaL6XsWb0vXbG2ZNAHoGxV7jQo= =g0fa -----END PGP SIGNATURE----- . - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201908-08 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: CUPS: Multiple vulnerabilities Date: August 15, 2019 Bugs: #660954 ID: 201908-08 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======== Multiple vulnerabilities have been found in CUPS, the worst of which could result in the arbitrary execution of code. Background ========== CUPS, the Common Unix Printing System, is a full-featured print server. Affected packages ================= ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 net-print/cups < 2.2.8 >= 2.2.8 Description =========== Multiple vulnerabilities have been discovered in CUPS. Please review the CVE identifiers referenced below for details. Impact ====== Please review the referenced CVE identifiers for details. Workaround ========== There is no known workaround at this time. Resolution ========== All CUPS users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=net-print/cups-2.2.8" References ========== [ 1 ] CVE-2017-15400 https://nvd.nist.gov/vuln/detail/CVE-2017-15400 [ 2 ] CVE-2018-4180 https://nvd.nist.gov/vuln/detail/CVE-2018-4180 [ 3 ] CVE-2018-4181 https://nvd.nist.gov/vuln/detail/CVE-2018-4181 [ 4 ] CVE-2018-4182 https://nvd.nist.gov/vuln/detail/CVE-2018-4182 [ 5 ] CVE-2018-4183 https://nvd.nist.gov/vuln/detail/CVE-2018-4183 [ 6 ] CVE-2018-6553 https://nvd.nist.gov/vuln/detail/CVE-2018-6553 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/201908-08 Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org. License ======= Copyright 2019 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. https://creativecommons.org/licenses/by-sa/2.5

Trust: 1.98

sources: NVD: CVE-2018-4182 // JVNDB: JVNDB-2018-013601 // VULHUB: VHN-134213 // VULMON: CVE-2018-4182 // PACKETSTORM: 148503 // PACKETSTORM: 154076

AFFECTED PRODUCTS

vendor:applemodel:mac os xscope:ltversion:10.13.5

Trust: 1.0

vendor:applemodel:mac os xscope:eqversion:10.13.4

Trust: 0.8

vendor:applemodel:mac os xscope:eqversion:10.0.4

Trust: 0.6

vendor:applemodel:mac os xscope:eqversion:10.1

Trust: 0.6

vendor:applemodel:mac os xscope:eqversion:10.0.0

Trust: 0.6

vendor:applemodel:mac os xscope:eqversion:10.1.0

Trust: 0.6

vendor:applemodel:mac os xscope:eqversion:10.0.1

Trust: 0.6

vendor:applemodel:mac os xscope:eqversion: -

Trust: 0.6

vendor:applemodel:mac os xscope:eqversion:10.1.1

Trust: 0.6

vendor:applemodel:mac os xscope:eqversion:10.0

Trust: 0.6

vendor:applemodel:mac os xscope:eqversion:10.0.3

Trust: 0.6

vendor:applemodel:mac os xscope:eqversion:10.0.2

Trust: 0.6

sources: JVNDB: JVNDB-2018-013601 // CNNVD: CNNVD-201901-395 // NVD: CVE-2018-4182

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2018-4182
value: HIGH

Trust: 1.0

NVD: CVE-2018-4182
value: HIGH

Trust: 0.8

CNNVD: CNNVD-201901-395
value: HIGH

Trust: 0.6

VULHUB: VHN-134213
value: HIGH

Trust: 0.1

VULMON: CVE-2018-4182
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2018-4182
severity: HIGH
baseScore: 7.2
vectorString: AV:L/AC:L/AU:N/C:C/I:C/A:C
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 3.9
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

VULHUB: VHN-134213
severity: HIGH
baseScore: 7.2
vectorString: AV:L/AC:L/AU:N/C:C/I:C/A:C
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 3.9
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2018-4182
baseSeverity: HIGH
baseScore: 8.2
vectorString: CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 1.5
impactScore: 6.0
version: 3.0

Trust: 1.8

sources: VULHUB: VHN-134213 // VULMON: CVE-2018-4182 // JVNDB: JVNDB-2018-013601 // CNNVD: CNNVD-201901-395 // NVD: CVE-2018-4182

PROBLEMTYPE DATA

problemtype:NVD-CWE-noinfo

Trust: 1.0

problemtype:CWE-285

Trust: 0.9

sources: VULHUB: VHN-134213 // JVNDB: JVNDB-2018-013601 // NVD: CVE-2018-4182

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-201901-395

TYPE

authorization issue

Trust: 0.6

sources: CNNVD: CNNVD-201901-395

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2018-013601

PATCH
title:HT208849url:https://support.apple.com/en-us/HT208849
Trust: 0.8
title:HT208849url:https://support.apple.com/ja-jp/HT208849
Trust: 0.8
title:Apple macOS High Sierra CUPS Security vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=88559
Trust: 0.6
title:Debian CVElist Bug Report Logs: cups: CVE-2018-6553url:https://vulmon.com/vendoradvisory?qidtp=debian_cvelist_bugreportlogs&qid=6c21552f0cd7f35a80acbcf87758caaf
Trust: 0.1
sources:
            
            
            VULMON: CVE-2018-4182 // 
            
            
            
            JVNDB: JVNDB-2018-013601 // 
            
            
            
            CNNVD: CNNVD-201901-395

EXTERNAL IDS
db:NVDid:CVE-2018-4182
Trust: 2.8
db:JVNid:JVNVU98864649
Trust: 0.8
db:JVNDBid:JVNDB-2018-013601
Trust: 0.8
db:CNNVDid:CNNVD-201901-395
Trust: 0.7
db:PACKETSTORMid:154076
Trust: 0.7
db:VULHUBid:VHN-134213
Trust: 0.1
db:VULMONid:CVE-2018-4182
Trust: 0.1
db:PACKETSTORMid:148503
Trust: 0.1
sources:
            
            
            VULHUB: VHN-134213 // 
            
            
            
            VULMON: CVE-2018-4182 // 
            
            
            
            JVNDB: JVNDB-2018-013601 // 
            
            
            
            PACKETSTORM: 148503 // 
            
            
            
            PACKETSTORM: 154076 // 
            
            
            
            CNNVD: CNNVD-201901-395 // 
            
            
            
            NVD: CVE-2018-4182

REFERENCES
url:https://security.gentoo.org/glsa/201908-08
Trust: 1.9
url:https://support.apple.com/ht208849
Trust: 1.8
url:https://www.debian.org/security/2018/dsa-4243
Trust: 1.8
url:https://access.redhat.com/security/cve/cve-2018-4182
Trust: 1.7
url:https://nvd.nist.gov/vuln/detail/cve-2018-4182
Trust: 1.0
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-4182
Trust: 0.8
url:https://jvn.jp/vu/jvnvu98864649/index.html
Trust: 0.8
url:https://packetstormsecurity.com/files/154076/gentoo-linux-security-advisory-201908-08.html
Trust: 0.6
url:https://nvd.nist.gov/vuln/detail/cve-2018-4183
Trust: 0.2
url:https://nvd.nist.gov/vuln/detail/cve-2018-6553
Trust: 0.2
url:https://nvd.nist.gov/vuln/detail/cve-2018-4180
Trust: 0.2
url:https://nvd.nist.gov/vuln/detail/cve-2018-4181
Trust: 0.2
url:https://nvd.nist.gov/vuln/detail/cve-2017-15400
Trust: 0.2
url:https://cwe.mitre.org/data/definitions/.html
Trust: 0.1
url:https://nvd.nist.gov
Trust: 0.1
url:https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=903605
Trust: 0.1
url:https://www.debian.org/security/faq
Trust: 0.1
url:https://www.debian.org/security/
Trust: 0.1
url:https://security-tracker.debian.org/tracker/cups
Trust: 0.1
url:https://creativecommons.org/licenses/by-sa/2.5
Trust: 0.1
url:https://security.gentoo.org/
Trust: 0.1
url:https://bugs.gentoo.org.
Trust: 0.1
sources:
            
            
            VULHUB: VHN-134213 // 
            
            
            
            VULMON: CVE-2018-4182 // 
            
            
            
            JVNDB: JVNDB-2018-013601 // 
            
            
            
            PACKETSTORM: 148503 // 
            
            
            
            PACKETSTORM: 154076 // 
            
            
            
            CNNVD: CNNVD-201901-395 // 
            
            
            
            NVD: CVE-2018-4182

CREDITS
Gentoo
Trust: 0.7
sources:
            
            
            PACKETSTORM: 154076 // 
            
            
            
            CNNVD: CNNVD-201901-395

SOURCES
db:VULHUBid:VHN-134213
db:VULMONid:CVE-2018-4182
db:JVNDBid:JVNDB-2018-013601
db:PACKETSTORMid:148503
db:PACKETSTORMid:154076
db:CNNVDid:CNNVD-201901-395
db:NVDid:CVE-2018-4182

LAST UPDATE DATE
2024-11-23T20:14:18.922000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-134213date:2019-10-03T00:00:00
db:VULMONid:CVE-2018-4182date:2019-10-03T00:00:00
db:JVNDBid:JVNDB-2018-013601date:2019-02-26T00:00:00
db:CNNVDid:CNNVD-201901-395date:2019-10-23T00:00:00
db:NVDid:CVE-2018-4182date:2024-11-21T04:06:55.307

SOURCES RELEASE DATE
db:VULHUBid:VHN-134213date:2019-01-11T00:00:00
db:VULMONid:CVE-2018-4182date:2019-01-11T00:00:00
db:JVNDBid:JVNDB-2018-013601date:2019-02-26T00:00:00
db:PACKETSTORMid:148503date:2018-07-11T15:36:35
db:PACKETSTORMid:154076date:2019-08-15T20:22:49
db:CNNVDid:CNNVD-201901-395date:2019-01-14T00:00:00
db:NVDid:CVE-2018-4182date:2019-01-11T18:29:01.127