CVE-2004-2154

Critical

Published: 31/12/2004(UTC)Translated: 30/05/2026(UTC)NVD NIST

Summary

The vulnerability in CUPS before version 1.1.21rc1 is that the Location directive in cupsd.conf is treated as case sensitive. This allows attackers to bypass intended ACLs by using a printer name containing uppercase or lowercase letters different from those specified in the directive.

Risk Assessment

The risk involves potential unauthorized access to printers, which could lead to data leakage or unauthorized use of printing resources in the organization.

Recommendation

It is recommended to upgrade CUPS to version 1.1.21rc1 or later, which fixes this vulnerability. If an upgrade is not possible, review and adjust the configuration of Location directives to account for all possible case variations in printer names.

Original NVD description (English source)

CUPS before 1.1.21rc1 treats a Location directive in cupsd.conf as case sensitive, which allows attackers to bypass intended ACLs via a printer name containing uppercase or lowercase letters that are different from what is specified in the directive.