CUPS Templating Engine Cross-site Scripting Vulnerability (CVE-2015-1159)
Severity: CRITICAL
Advisory Date: JUL 21, 2015
DESCRIPTION
A cross-site scripting bug in the CUPS templating engine allows this bug to be exploited when a user browses the web. In certain cases, the CGI template can echo user input to file rather than escaping the text first. This may be used to set up a reflected XSS attack in the QUERY parameter of the web interface help page. By default, many Linux distributions run with the web interface activated.
TREND MICRO PROTECTION INFORMATION
Apply associated Trend Micro DPI Rules.
SOLUTION
Trend Micro Deep Security DPI Rule Number: 1000552