CVE-2017-18190

Name of the Vulnerable Software and Affected Versions: CUPS versions prior to 2.2.2

Description: The issue allows remote attackers to execute arbitrary IPP commands by sending POST requests to the CUPS daemon in conjunction with DNS rebinding, potentially disrupting data integrity. This is due to a localhost.localdomain whitelist entry in the valid host() function in scheduler/client.c. The localhost.localdomain name is often resolved via a DNS server.

Recommendations: For versions prior to 2.2.2, update to version 2.2.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the CUPS daemon to minimize the risk of exploitation. Avoid using the valid host() function in conjunction with DNS rebinding until the issue is resolved.