rapid7/metasploit-framework — pull request #2280 by jvennix-r7 (2013-08-25 19:39:25+00:00)
Title: cve-2012-5519 CUPS root file read

[CVEDetails link](http://www.cvedetails.com/cve/CVE-2012-5519/)

More privilege escalation fun. Tested on OSX 10.7-10.8.3, and Ubuntu 12.0.4 (from before last december, they have backported the patch for this afaik). Allows a user that is part of the "lpadmin" group (e.g. a CUPS administrator) to read files owned by root. There is also a root write in here which maybe someone knows how to exploit (you can "write" by sending requests to the web interface, which end up in the "page log"... i could get ~400 chars in there before the log truncates the querystring).