Local File Read Vulnerability in CUPS Affected by Symlink Attack

CVE-2013-6891

Summary

The local file read vulnerability in CUPS prior to version 1.7.1 allows attackers to exploit the lppasswd command, which runs with setuid privileges. By manipulating the HOME environment variable in conjunction with a symlink attack that targets .cups/client.conf, local users can read sensitive portions of arbitrary files on the system. This issue raises significant security concerns as it can lead to exposure of confidential information and potential further exploitation.

References