cve/2015/CVE-2015-1158.md

CVE-2015-1158

Description

The add_job function in scheduler/ipp.c in cupsd in CUPS before 2.0.3 performs incorrect free operations for multiple-value job-originating-host-name attributes, which allows remote attackers to trigger data corruption for reference-counted strings via a crafted (1) IPP_CREATE_JOB or (2) IPP_PRINT_JOB request, as demonstrated by replacing the configuration file and consequently executing arbitrary code.

POC

Reference

• http://www.kb.cert.org/vuls/id/810572
• https://www.cups.org/str.php?L4609
• https://www.exploit-db.com/exploits/37336/
• https://www.exploit-db.com/exploits/41233/

Github

• https://github.com/ARPSyndicate/cvemon
• https://github.com/cedelasen/htb-passage
• https://github.com/chorankates/Irked