Yesterday details went public about a major security issue that was found in CUPS, the open source printing system.
If you wish to read all the details you can do so in the blog post from Simone Margaritelli who found the problems. It's pretty technical stuff that most normal users likely won't understand, but the main point is that if you're on a desktop Linux system especially there's a high chance your system is vulnerable to it (especially if you use printers).
The issues are:
- CVE-2024-47176 | cups-browsed <= 2.0.1 binds on UDP INADDR_ANY:631 trusting any packet from any source to trigger a
Get-Printer-AttributesIPP request to an attacker controlled URL.- CVE-2024-47076 | libcupsfilters <= 2.1b1
cfGetPrinterAttributes5does not validate or sanitize the IPP attributes returned from an IPP server, providing attacker controlled data to the rest of the CUPS system.- CVE-2024-47175 | libppd <= 2.1b1
ppdCreatePPDFromIPP2does not validate or sanitize the IPP attributes when writing them to a temporary PPD file, allowing the injection of attacker controlled data in the resulting PPD.- CVE-2024-47177 | cups-filters <= 2.0.1
foomatic-ripallows arbitrary command execution via theFoomaticRIPCommandLinePPD parameter.
Summed up by Margaritelli they said:
A remote unauthenticated attacker can silently replace existing printers’ (or install new ones) IPP urls with a malicious one, resulting in arbitrary command execution (on the computer) when a print job is started (from that computer).
Margaritelli also suggests actually removing and disabling any services for cups-browsed, especially if you don't need it and then running updates. Regularly checking for updates is just sound advice anyway, make sure you're up to date often for security fixes.
Red Hat and Canonical both have blog posts up on it and updates are rolling out for various distributions.
Article taken from GamingOnLinux.com.
hardpenguin Sep 27
Quoting: hardpenguinI appreciate the thumbnail of this newspost.Art is my passion.
Linux_Rocks Sep 27
soulsource 
Sep 27
To quote the blog post:
QuoteDisable and remove the cups-browsed service if you don’t need it (and probably you don’t).
The other recommendation is also something that I have been wondering about basically ever since those services were introduced:
QuoteI’m also removing every zeroconf / avahi / bonjour listener.
That stuff is nearly useless and increases attack surface.
Last edited by nenoro on 27 September 2024 at 2:59 pm UTC
Quoting: elmapulits even possible to fix that without breaking the functionally of all existing printers?Apparently the Foomatic printers require the kind of stupidity that caused the arbitrary code execution part, so when it comes to those the answer is probably "no". But I would guess that you can fix the issue while basically only breaking Foomatic and maybe making the necessary sacrifice of not getting automatic printer connections.
For most regular workstation users, this issue probably doesn't even really exist. At least in Fedora cups-browsed isn't enabled and the default firewall rules don't expose any CUPS services to the outside. Maybe Ubuntu does run it by default and exposes it, but then the question would probably be why?
I also don't really like how this thing was hyped to hell and back. Sure, it's a real issue in the sense that you can either DoS a CUPS install with the buffer overruns (a certified C language classic) or cause an RCE in some fairly narrow circumstances, but the hyping basically framed it as a damn apocalypse. There has to be some other way to get vulnerabilities fixed than by doing some kind of a salesman marketing spin campaign.
ElectricPrism Sep 28
Quoting: elmapulits even possible to fix that without breaking the functionally of all existing printers?
Create a MITM Print Server? Maybe from a Raspberry Pi? As for how you get the files from the device to the print server -- that's up to you really.
(Of course this implies eliminating cups from all LAN devices except the print server which is connected via USB or whatever.)
Last edited by ElectricPrism on 28 September 2024 at 4:17 am UTC
Patreon
PayPal
See more from me