Exploitation Summary
EIP tracks 2 public exploits for CVE-2015-1158. PoCs published by Google Security Research, @0x00string.
AI-analyzed exploit summary This is a detailed writeup describing an exploit chain for CVE-2015-1158, a reference count over-decrement vulnerability in CUPS. It includes analysis of the bug, exploitation steps, and a secondary XSS vulnerability (CVE-2015-1159) to bypass local host restrictions.
Description
The add_job function in scheduler/ipp.c in cupsd in CUPS before 2.0.3 performs incorrect free operations for multiple-value job-originating-host-name attributes, which allows remote attackers to trigger data corruption for reference-counted strings via a crafted (1) IPP_CREATE_JOB or (2) IPP_PRINT_JOB request, as demonstrated by replacing the configuration file and consequently executing arbitrary code.
Exploits (2)
This is a detailed writeup describing an exploit chain for CVE-2015-1158, a reference count over-decrement vulnerability in CUPS. It includes analysis of the bug, exploitation steps, and a secondary XSS vulnerability (CVE-2015-1159) to bypass local host restrictions.
This exploit targets a reference count over-decrement vulnerability in CUPS (CVE-2015-1158) to achieve remote code execution. It sends maliciously crafted IPP packets to trigger the vulnerability and can optionally load a shared library payload for post-exploitation.