製品・ソフトウェアに関する情報

JVN脆弱性詳細

CUPS における DNS リバインド攻撃を誘導される脆弱性

タイトル	CUPS における DNS リバインド攻撃を誘導される脆弱性
概要	CUPS のウェブインターフェースには、クライアントリクエスト内の HTTP Host ヘッダを検証しないため、DNS リバインド攻撃を誘導される脆弱性が存在します。
想定される影響	第三者により、DNS リバインド攻撃を誘導される可能性があります。
対策	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
公表日	2009年4月24日0:00
登録日	2009年6月25日14:50
最終更新日	2010年5月6日13:46

CVSS2.0 : 警告
スコア	6.4
ベクター	AV:N/AC:L/Au:N/C:N/I:P/A:P

影響を受けるシステム

ターボリナックス

Turbolinux Appliance Server 3.0

Turbolinux Appliance Server 3.0 (x64)

Turbolinux Client 2008

Turbolinux Server 11

Turbolinux Server 11 (x64)

アップル

Apple Mac OS X v10.4.11

Apple Mac OS X v10.5 から v10.5.6

Apple Mac OS X Server v10.4.11

Apple Mac OS X Server v10.5 から v10.5.6

CUPS

CUPS 1.3.10 未満

CVE (情報セキュリティ共通脆弱性識別子)

No	名前	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2009-0164	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0164
National Vulnerability Database (NVD)
2	CVE-2009-0164	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-0164

CWE (共通脆弱性タイプ一覧)

No	名前	URL
JVNDB
1	CWE-20	https://jvndb.jvn.jp/ja/cwe/CWE-20.html

ベンダー情報

No	名前	URL
Apple Security Updates
1	HT3549	http://support.apple.com/kb/HT3549
Apple セキュリティアップデート
2	HT3549	http://support.apple.com/kb/HT3549?viewlocale=ja_JP
CUPS
3	CUPS 1.3.10	http://www.cups.org/articles.php?L582
4	STR #3118	http://www.cups.org/str.php?L3118
富士通セキュリティ情報
5	TA09-133A	http://software.fujitsu.com/jp/security/vulnerabilities/ta09-133a.html
製品セキュリティ情報
6	TLSA-2010-13	http://www.turbolinux.co.jp/security/2010/TLSA-2010-13j.txt

その他

No	名前	URL
JVN
1	JVNTA09-133A	http://jvn.jp/cert/JVNTA09-133A/
JVN Status Tracking Notes
2	JVNTR-2009-12	http://jvn.jp/tr/JVNTR-2009-12
Secunia Advisory
3	SA35074	http://secunia.com/advisories/35074
SecurityFocus
4	34665	http://www.securityfocus.com/bid/34665
US-CERT Cyber Security Alerts
5	SA09-133A	http://www.us-cert.gov/cas/alerts/SA09-133A.html
US-CERT Technical Cyber Security Alert
6	TA09-133A	http://www.us-cert.gov/cas/techalerts/TA09-133A.html
VUPEN Security
7	VUPEN/ADV-2009-1297	http://www.vupen.com/english/advisories/2009/1297

変更履歴

No	変更内容	変更日
0	[2009年06月25日] 掲載 [2010年05月06日] 影響を受けるシステム：ターボリナックス (TLSA-2010-13) の情報を追加ベンダ情報：ターボリナックス (TLSA-2010-13) を追加	2018年2月17日10:37

NVD脆弱性情報

CVE-2009-0164

概要	The web interface for CUPS before 1.3.10 does not validate the HTTP Host header in a client request, which makes it easier for remote attackers to conduct DNS rebinding attacks.
概要	La interfaz web de CUPS antes de v1.3.10 no valida la cabecera HTTP Host en una solicitud de un cliente, lo que facilita para realizar ataques de revinculación de DNS a atacantes remotos.
公表日	2009年4月25日0:30
登録日	2021年1月29日13:13
最終更新日	2026年4月23日9:35

影響を受けるソフトウェアの構成

構成1	以上	以下	より上	未満
cpe:2.3:a:apple:cups::::::::		1.3.9
cpe:2.3:a:apple:cups:1.1:::::::*
cpe:2.3:a:apple:cups:1.1.1:::::::*
cpe:2.3:a:apple:cups:1.1.2:::::::*
cpe:2.3:a:apple:cups:1.1.3:::::::*
cpe:2.3:a:apple:cups:1.1.4:::::::*
cpe:2.3:a:apple:cups:1.1.5:::::::*
cpe:2.3:a:apple:cups:1.1.5-1:::::::*
cpe:2.3:a:apple:cups:1.1.5-2:::::::*
cpe:2.3:a:apple:cups:1.1.6:::::::*
cpe:2.3:a:apple:cups:1.1.6-1:::::::*
cpe:2.3:a:apple:cups:1.1.6-2:::::::*
cpe:2.3:a:apple:cups:1.1.6-3:::::::*
cpe:2.3:a:apple:cups:1.1.7:::::::*
cpe:2.3:a:apple:cups:1.1.8:::::::*
cpe:2.3:a:apple:cups:1.1.9:::::::*
cpe:2.3:a:apple:cups:1.1.9-1:::::::*
cpe:2.3:a:apple:cups:1.1.10:::::::*
cpe:2.3:a:apple:cups:1.1.10-1:::::::*
cpe:2.3:a:apple:cups:1.1.11:::::::*
cpe:2.3:a:apple:cups:1.1.12:::::::*
cpe:2.3:a:apple:cups:1.1.13:::::::*
cpe:2.3:a:apple:cups:1.1.14:::::::*
cpe:2.3:a:apple:cups:1.1.15:::::::*
cpe:2.3:a:apple:cups:1.1.16:::::::*
cpe:2.3:a:apple:cups:1.1.17:::::::*
cpe:2.3:a:apple:cups:1.1.18:::::::*
cpe:2.3:a:apple:cups:1.1.19:::::::*
cpe:2.3:a:apple:cups:1.1.19:rc1::::::
cpe:2.3:a:apple:cups:1.1.19:rc2::::::
cpe:2.3:a:apple:cups:1.1.19:rc3::::::
cpe:2.3:a:apple:cups:1.1.19:rc4::::::
cpe:2.3:a:apple:cups:1.1.19:rc5::::::
cpe:2.3:a:apple:cups:1.1.20:::::::*
cpe:2.3:a:apple:cups:1.1.20:rc1::::::
cpe:2.3:a:apple:cups:1.1.20:rc2::::::
cpe:2.3:a:apple:cups:1.1.20:rc3::::::
cpe:2.3:a:apple:cups:1.1.20:rc4::::::
cpe:2.3:a:apple:cups:1.1.20:rc5::::::
cpe:2.3:a:apple:cups:1.1.20:rc6::::::
cpe:2.3:a:apple:cups:1.1.21:::::::*
cpe:2.3:a:apple:cups:1.1.21:rc1::::::
cpe:2.3:a:apple:cups:1.1.21:rc2::::::
cpe:2.3:a:apple:cups:1.1.22:::::::*
cpe:2.3:a:apple:cups:1.1.22:rc1::::::
cpe:2.3:a:apple:cups:1.1.22:rc2::::::
cpe:2.3:a:apple:cups:1.1.23:::::::*
cpe:2.3:a:apple:cups:1.1.23:rc1::::::
cpe:2.3:a:apple:cups:1.2:b1::::::
cpe:2.3:a:apple:cups:1.2:b2::::::
cpe:2.3:a:apple:cups:1.2:rc1::::::
cpe:2.3:a:apple:cups:1.2:rc2::::::
cpe:2.3:a:apple:cups:1.2:rc3::::::
cpe:2.3:a:apple:cups:1.2.0:::::::*
cpe:2.3:a:apple:cups:1.2.1:::::::*
cpe:2.3:a:apple:cups:1.2.2:::::::*
cpe:2.3:a:apple:cups:1.2.3:::::::*
cpe:2.3:a:apple:cups:1.2.4:::::::*
cpe:2.3:a:apple:cups:1.2.5:::::::*
cpe:2.3:a:apple:cups:1.2.6:::::::*
cpe:2.3:a:apple:cups:1.2.7:::::::*
cpe:2.3:a:apple:cups:1.2.8:::::::*
cpe:2.3:a:apple:cups:1.2.9:::::::*
cpe:2.3:a:apple:cups:1.2.10:::::::*
cpe:2.3:a:apple:cups:1.2.11:::::::*
cpe:2.3:a:apple:cups:1.2.12:::::::*
cpe:2.3:a:apple:cups:1.3:b1::::::
cpe:2.3:a:apple:cups:1.3:rc1::::::
cpe:2.3:a:apple:cups:1.3:rc2::::::
cpe:2.3:a:apple:cups:1.3.0:::::::*
cpe:2.3:a:apple:cups:1.3.1:::::::*
cpe:2.3:a:apple:cups:1.3.2:::::::*
cpe:2.3:a:apple:cups:1.3.3:::::::*
cpe:2.3:a:apple:cups:1.3.4:::::::*
cpe:2.3:a:apple:cups:1.3.5:::::::*
cpe:2.3:a:apple:cups:1.3.6:::::::*
cpe:2.3:a:apple:cups:1.3.7:::::::*
cpe:2.3:a:apple:cups:1.3.8:::::::*

関連情報、対策とツール

No	URL	refsource
1	http://bugs.gentoo.org/show_bug.cgi?id=263070	cve@mitre.org
2	http://lists.apple.com/archives/security-announce/2009/May/msg00002.html	cve@mitre.org
3	http://secunia.com/advisories/35074	cve@mitre.org
4	http://security.gentoo.org/glsa/glsa-200904-20.xml	cve@mitre.org
5	http://support.apple.com/kb/HT3549	cve@mitre.org
6	http://wiki.rpath.com/Advisories:rPSA-2009-0061	cve@mitre.org
7	http://www.cups.org/articles.php?L582	cve@mitre.org
8	http://www.cups.org/str.php?L3118	cve@mitre.org
9	http://www.securityfocus.com/archive/1/502750/100/0/threaded	cve@mitre.org
10	http://www.securityfocus.com/bid/34665	cve@mitre.org
11	http://www.us-cert.gov/cas/techalerts/TA09-133A.html	cve@mitre.org
12	http://www.vupen.com/english/advisories/2009/1297	cve@mitre.org
13	https://bugzilla.redhat.com/show_bug.cgi?id=490597	cve@mitre.org
14	http://bugs.gentoo.org/show_bug.cgi?id=263070	af854a3a-2127-422b-91ae-364da2661108
15	http://lists.apple.com/archives/security-announce/2009/May/msg00002.html	af854a3a-2127-422b-91ae-364da2661108
16	http://secunia.com/advisories/35074	af854a3a-2127-422b-91ae-364da2661108
17	http://security.gentoo.org/glsa/glsa-200904-20.xml	af854a3a-2127-422b-91ae-364da2661108
18	http://support.apple.com/kb/HT3549	af854a3a-2127-422b-91ae-364da2661108
19	http://wiki.rpath.com/Advisories:rPSA-2009-0061	af854a3a-2127-422b-91ae-364da2661108
20	http://www.cups.org/articles.php?L582	af854a3a-2127-422b-91ae-364da2661108
21	http://www.cups.org/str.php?L3118	af854a3a-2127-422b-91ae-364da2661108
22	http://www.securityfocus.com/archive/1/502750/100/0/threaded	af854a3a-2127-422b-91ae-364da2661108
23	http://www.securityfocus.com/bid/34665	af854a3a-2127-422b-91ae-364da2661108
24	http://www.us-cert.gov/cas/techalerts/TA09-133A.html	af854a3a-2127-422b-91ae-364da2661108
25	http://www.vupen.com/english/advisories/2009/1297	af854a3a-2127-422b-91ae-364da2661108
26	https://bugzilla.redhat.com/show_bug.cgi?id=490597	af854a3a-2127-422b-91ae-364da2661108

共通脆弱性一覧

No	CWE	名前	URL
1	CWE-20	不適切な入力確認	https://cwe.mitre.org/data/definitions/20.html

構成1	以上	以下	より上	未満
cpe:2.3:a:apple:cups::::::::		1.3.9
cpe:2.3:a:apple:cups:1.1:::::::*
cpe:2.3:a:apple:cups:1.1.1:::::::*
cpe:2.3:a:apple:cups:1.1.2:::::::*
cpe:2.3:a:apple:cups:1.1.3:::::::*
cpe:2.3:a:apple:cups:1.1.4:::::::*
cpe:2.3:a:apple:cups:1.1.5:::::::*
cpe:2.3:a:apple:cups:1.1.5-1:::::::*
cpe:2.3:a:apple:cups:1.1.5-2:::::::*
cpe:2.3:a:apple:cups:1.1.6:::::::*
cpe:2.3:a:apple:cups:1.1.6-1:::::::*
cpe:2.3:a:apple:cups:1.1.6-2:::::::*
cpe:2.3:a:apple:cups:1.1.6-3:::::::*
cpe:2.3:a:apple:cups:1.1.7:::::::*
cpe:2.3:a:apple:cups:1.1.8:::::::*
cpe:2.3:a:apple:cups:1.1.9:::::::*
cpe:2.3:a:apple:cups:1.1.9-1:::::::*
cpe:2.3:a:apple:cups:1.1.10:::::::*
cpe:2.3:a:apple:cups:1.1.10-1:::::::*
cpe:2.3:a:apple:cups:1.1.11:::::::*
cpe:2.3:a:apple:cups:1.1.12:::::::*
cpe:2.3:a:apple:cups:1.1.13:::::::*
cpe:2.3:a:apple:cups:1.1.14:::::::*
cpe:2.3:a:apple:cups:1.1.15:::::::*
cpe:2.3:a:apple:cups:1.1.16:::::::*
cpe:2.3:a:apple:cups:1.1.17:::::::*
cpe:2.3:a:apple:cups:1.1.18:::::::*
cpe:2.3:a:apple:cups:1.1.19:::::::*
cpe:2.3:a:apple:cups:1.1.19:rc1::::::
cpe:2.3:a:apple:cups:1.1.19:rc2::::::
cpe:2.3:a:apple:cups:1.1.19:rc3::::::
cpe:2.3:a:apple:cups:1.1.19:rc4::::::
cpe:2.3:a:apple:cups:1.1.19:rc5::::::
cpe:2.3:a:apple:cups:1.1.20:::::::*
cpe:2.3:a:apple:cups:1.1.20:rc1::::::
cpe:2.3:a:apple:cups:1.1.20:rc2::::::
cpe:2.3:a:apple:cups:1.1.20:rc3::::::
cpe:2.3:a:apple:cups:1.1.20:rc4::::::
cpe:2.3:a:apple:cups:1.1.20:rc5::::::
cpe:2.3:a:apple:cups:1.1.20:rc6::::::
cpe:2.3:a:apple:cups:1.1.21:::::::*
cpe:2.3:a:apple:cups:1.1.21:rc1::::::
cpe:2.3:a:apple:cups:1.1.21:rc2::::::
cpe:2.3:a:apple:cups:1.1.22:::::::*
cpe:2.3:a:apple:cups:1.1.22:rc1::::::
cpe:2.3:a:apple:cups:1.1.22:rc2::::::
cpe:2.3:a:apple:cups:1.1.23:::::::*
cpe:2.3:a:apple:cups:1.1.23:rc1::::::
cpe:2.3:a:apple:cups:1.2:b1::::::
cpe:2.3:a:apple:cups:1.2:b2::::::
cpe:2.3:a:apple:cups:1.2:rc1::::::
cpe:2.3:a:apple:cups:1.2:rc2::::::
cpe:2.3:a:apple:cups:1.2:rc3::::::
cpe:2.3:a:apple:cups:1.2.0:::::::*
cpe:2.3:a:apple:cups:1.2.1:::::::*
cpe:2.3:a:apple:cups:1.2.2:::::::*
cpe:2.3:a:apple:cups:1.2.3:::::::*
cpe:2.3:a:apple:cups:1.2.4:::::::*
cpe:2.3:a:apple:cups:1.2.5:::::::*
cpe:2.3:a:apple:cups:1.2.6:::::::*
cpe:2.3:a:apple:cups:1.2.7:::::::*
cpe:2.3:a:apple:cups:1.2.8:::::::*
cpe:2.3:a:apple:cups:1.2.9:::::::*
cpe:2.3:a:apple:cups:1.2.10:::::::*
cpe:2.3:a:apple:cups:1.2.11:::::::*
cpe:2.3:a:apple:cups:1.2.12:::::::*
cpe:2.3:a:apple:cups:1.3:b1::::::
cpe:2.3:a:apple:cups:1.3:rc1::::::
cpe:2.3:a:apple:cups:1.3:rc2::::::
cpe:2.3:a:apple:cups:1.3.0:::::::*
cpe:2.3:a:apple:cups:1.3.1:::::::*
cpe:2.3:a:apple:cups:1.3.2:::::::*
cpe:2.3:a:apple:cups:1.3.3:::::::*
cpe:2.3:a:apple:cups:1.3.4:::::::*
cpe:2.3:a:apple:cups:1.3.5:::::::*
cpe:2.3:a:apple:cups:1.3.6:::::::*
cpe:2.3:a:apple:cups:1.3.7:::::::*
cpe:2.3:a:apple:cups:1.3.8:::::::*