Improper Authentication in macOS - CVE-2023-32360

Vulnerability identifier: #VU76308

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-32360

CWE-ID: CWE-287

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to missing authentication in CUPS. A remote attacker can access recently printed documents.

macOS
Amazon Linux AMI
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise Software Development Kit 12
SUSE CaaS Platform
SUSE Manager Server
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Linux Enterprise Micro for Rancher
SUSE Linux Enterprise Micro
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for Scientific Computing
Anolis OS
Red Hat Enterprise Linux for Power, big endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux Desktop
CentOS
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
SUSE Enterprise Storage
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for x86_64 - Extended Update Support
SUSE OpenStack Cloud Crowbar
SUSE OpenStack Cloud
SUSE Linux Enterprise Server 12 SP2 BCL
SUSE Linux Enterprise Server 12 SP4 ESPOS
SUSE Linux Enterprise Server 12 SP4 LTSS
SUSE Linux Enterprise Server 15 SP1 LTSS
SUSE Linux Enterprise High Performance Computing 15 SP1 LTSS
SUSE Linux Enterprise Server 15 SP2 LTSS
SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS
SUSE Linux Enterprise Server 15 SP3 LTSS
Basesystem Module
Development Tools Module
Desktop Applications Module
openSUSE Leap
Ubuntu
OpenShift API for Data Protection (OADP)
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
OpenShift Logging
Red Hat Migration Toolkit for Applications
Red Hat OpenShift Dev Spaces
Session Smart Router
IBM Cloud Pak for Watson AIOps
Robotic Process Automation for Cloud Pak
Storage Defender – Data Protect
EMC Cloud Tiering Appliance
Red Hat OpenShift Container Platform
Juniper Secure Analytics (JSA)
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
cups (Ubuntu package)
cups
cups-client
cups-devel
cups-ipptool
cups-libs
cups-lpd
cups-filesystem
cups (Red Hat package)
cups-libs-debuginfo-32bit
cups-libs-32bit
cups-debugsource
cups-debuginfo
cups-client-debuginfo
cups-libs-debuginfo
cups-ddk-debuginfo
cups-ddk
cups-doc
libcupsmime1
libcupscgi1-32bit-debuginfo
libcupscgi1-debuginfo
libcups2-debuginfo
libcups2
cups-config
libcupsimage2
libcupsppdc1
libcupsppdc1-32bit
cups-devel-32bit
libcupsimage2-32bit-debuginfo
libcupscgi1-32bit
libcups2-32bit
libcupsmime1-32bit
libcupsppdc1-32bit-debuginfo
libcupsmime1-32bit-debuginfo
libcupsimage2-32bit
libcupsmime1-debuginfo
libcupsimage2-debuginfo
libcupscgi1
libcups2-32bit-debuginfo
libcupsppdc1-debuginfo
RecoverPoint for VMs
IBM Qradar SIEM

Install updates from vendor's website.

macOS - addressed in versions 13.4 22F66, 11.7.7 20G1345, 12.6.6 21G646
OpenShift API for Data Protection (OADP) - update to 1.1.6
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - update to 4.8.0
Red Hat OpenShift Container Platform - update to 4.11.49
OpenShift Logging - addressed in versions 5.5.16, 5.6.11, 5.7.6
Red Hat Migration Toolkit for Applications - update to 6.2.1
Juniper Secure Analytics (JSA) - addressed in versions 7.5.0 UP7 IF05, 7.5.0 UP8 IF03
Robotic Process Automation for Cloud Pak - addressed in versions 21.0.7.11, 23.0.12
cups (Ubuntu package) - addressed in versions Ubuntu Pro, 2.3.1-9ubuntu1.5, 2.4.1op1-1ubuntu4.6, 2.4.2-3ubuntu2.4
cups - addressed in versions 1.4.2-67.24, 1.4.2-67.25
cups-client - addressed in versions 1.6.3-52, 2.2.6-52.0.1
cups - addressed in versions 1.6.3-52, 2.2.6-52.0.1
cups-devel - addressed in versions 1.6.3-52, 2.2.6-52.0.1
cups-ipptool - addressed in versions 1.6.3-52, 2.2.6-52.0.1
cups-libs - addressed in versions 1.6.3-52, 2.2.6-52.0.1
cups-lpd - addressed in versions 1.6.3-52, 2.2.6-52.0.1
cups-filesystem - addressed in versions 1.6.3-52, 2.2.6-52.0.1
cups (Red Hat package) - addressed in versions 1.6.3-52.el7_9, 2.2.6-28.el8_1.2, 2.2.6-33.el8_2.2, 2.2.6-38.el8_4.2, 2.2.6-45.el8_6.3, 2.2.6-51.el8_8.1, 2.3.3op2-13.el9_0.2, 2.3.3op2-16.el9_2.1
cups-libs-debuginfo-32bit - update to 1.7.5-20.46.1
cups-libs-32bit - update to 1.7.5-20.46.1
cups-debugsource - addressed in versions 1.7.5-20.46.1, 2.2.7-150000.3.51.2
cups-client - addressed in versions 1.7.5-20.46.1, 2.2.7-150000.3.51.2
cups-debuginfo - addressed in versions 1.7.5-20.46.1, 2.2.7-150000.3.51.2
cups-client-debuginfo - addressed in versions 1.7.5-20.46.1, 2.2.7-150000.3.51.2
cups-libs - update to 1.7.5-20.46.1
cups-libs-debuginfo - update to 1.7.5-20.46.1
cups-devel - addressed in versions 1.7.5-20.46.1, 2.2.7-150000.3.51.2
cups-ddk-debuginfo - addressed in versions 1.7.5-20.46.1, 2.2.7-150000.3.51.2
cups-ddk - addressed in versions 1.7.5-20.46.1, 2.2.7-150000.3.51.2
cups - addressed in versions 1.7.5-20.46.1, 2.2.7-150000.3.51.2
Storage Defender – Data Protect - update to 2.0
cups-doc - update to 2.2.6-52.0.1
libcupsmime1 - update to 2.2.7-150000.3.51.2
libcupscgi1-32bit-debuginfo - update to 2.2.7-150000.3.51.2
libcupscgi1-debuginfo - update to 2.2.7-150000.3.51.2
libcups2-debuginfo - update to 2.2.7-150000.3.51.2
libcups2 - update to 2.2.7-150000.3.51.2
cups-config - update to 2.2.7-150000.3.51.2
libcupsimage2 - update to 2.2.7-150000.3.51.2
libcupsppdc1 - update to 2.2.7-150000.3.51.2
libcupsppdc1-32bit - update to 2.2.7-150000.3.51.2
cups-devel-32bit - update to 2.2.7-150000.3.51.2
libcupsimage2-32bit-debuginfo - update to 2.2.7-150000.3.51.2
libcupscgi1-32bit - update to 2.2.7-150000.3.51.2
libcups2-32bit - update to 2.2.7-150000.3.51.2
libcupsmime1-32bit - update to 2.2.7-150000.3.51.2
libcupsppdc1-32bit-debuginfo - update to 2.2.7-150000.3.51.2
libcupsmime1-32bit-debuginfo - update to 2.2.7-150000.3.51.2
libcupsimage2-32bit - update to 2.2.7-150000.3.51.2
libcupsmime1-debuginfo - update to 2.2.7-150000.3.51.2
libcupsimage2-debuginfo - update to 2.2.7-150000.3.51.2
libcupscgi1 - update to 2.2.7-150000.3.51.2
libcups2-32bit-debuginfo - update to 2.2.7-150000.3.51.2
libcupsppdc1-debuginfo - update to 2.2.7-150000.3.51.2
Red Hat OpenShift Dev Spaces - update to 3.15.0
RecoverPoint for VMs - update to 6.0.SP1.P1
Session Smart Router - addressed in versions 6.2.3-r2, 6.2.10, 6.3.7
IBM Qradar SIEM - update to 7.5.0 Update Pack 7 IF05
EMC Cloud Tiering Appliance - update to 13.1.0.2.35

• https://support.apple.com/en-us/HT213758

• Multiple vulnerabilities in macOS Ventura
• Multiple vulnerabilities in macOS Monterey
• Multiple vulnerabilities in Apple macOS Big Sur
• Red Hat Enterprise Linux 8 update for cups
• Red Hat Enterprise Linux 8.6 Extended Update Support update for cups
• Red Hat Enterprise Linux 9.0 Extended Update Support update for cups
• Red Hat Enterprise Linux 8 update for cups
• Red Hat Enterprise Linux 7 update for cups
• Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions update for cups
• Red Hat Enterprise Linux 9 update for cups
• Red Hat Enterprise Linux 8 update for cups
• Ubuntu update for cups
• Multiple vulnerabilities in Logging Subsystem for Red Hat OpenShift
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.11
• SUSE update for cups
• SUSE update for cups
• Multiple vulnerabilities in Logging Subsystem 5.5 for Red Hat OpenShift
• Multiple vulnerabilities in Logging Subsystem 5.6 for Red Hat OpenShift
• Multiple vulnerabilities in OpenShift API for Data Protection (OADP) 1.1
• Amazon Linux AMI update for cups
• Ubuntu update for cups
• SUSE update for cups
• Multiple vulnerabilities in Migration Toolkit for Applications 6.2
• Dell EMC Cloud Tiering Appliance update for third-party software
• IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data update for cups
• Multiple vulnerabilities in IBM Cloud Pak for Watson AIOps
• Multiple vulnerabilities in IBM Storage Defender - Data Protect
• Multiple vulnerabilities in Juniper Networks Session Smart Router
• CentOS 7 update for cups
• Multiple vulnerabilities in IBM Robotic Process Automation for Cloud Pak
• Multiple vulnerabilities in IBM QRadar SIEM
• Multiple vulnerabilities in Juniper Secure Analytics (JSA)
• Multiple vulnerabilities in Juniper Secure Analytics (JSA)
• Multiple vulnerabilities in Red Hat OpenShift Dev Spaces
• Multiple vulnerabilities in Dell RecoverPoint for Virtual Machines
• Amazon Linux AMI update for cups
• Anolis OS update for cups
• Anolis OS update for cups
• Juniper Session Smart Router update for third-party components