Cups vulnerability

[kc1di]

This may be of interest to some, But most systems are not affected.

CUPS flaws enable Linux remote code execution, but there’s a catch

Under certain conditions, attackers can chain a set of vulnerabilities in multiple components of the CUPS open-source printing system to execute arbitrary code remotely on vulnerable machines.

www.bleepingcomputer.com

 

[f33dm3bits]

Attacking UNIX Systems via CUPS, Part I

Hello friends, this is the first of two, possibly three (if and when I have time to finish the Windows research) writeups. We will start with targeting GNU/Linux systems with an RCE. As someone who’s

www.evilsocket.net

Red Hat’s response to OpenPrinting CUPS vulnerabilities: CVE-2024-47076, CVE-2024-47175, CVE-2024-47176 and CVE-2024-47177

An overview and mitigation information for the vulnerabilities affecting OpenPrinting CUPS.

www.redhat.com

 

[tinfoil-hat]

How serious is this problem on a debian based desktop os? I have cups installed and there was no cups update as of today

 

[kc1di]

How serious is this problem on a debian based desktop os? I have cups installed and there was no cups update as of today

The threat only exists if you have cups-browsed daemon activated, on most Desktops it is turned off by default so you should be safe. Cups-browsed is use to find network remote printers. If you using an internet printing service or have your printer on a network that you do not control you may have an issue. Also check to see if port 631 is active that the port it uses.

 

[tinfoil-hat]

The threat only exists if you have cups-browsed daemon activated, on most Desktops it is turned off by default so you should be safe. Cups-browsed is use to find network remote printers. If you using an internet printing service or have your printer on a network that you do not control you may have an issue. Also check to see if port 631 is active that the port it uses.

I know i have it enabled, that's why i am asking. I have a network printer. how big is the risk? should i disable cups till theres a fix?

 

[f33dm3bits]

I know i have it enabled, that's why i am asking. I have a network printer. how big is the risk? should i disable cups till theres a fix?

Just stop and disable it until Debian comes with a patch, it's not like you are printing a book a day I would think?

CVE-2024-47177

 

[kc1di]

I know i have it enabled, that's why i am asking. I have a network printer. how big is the risk? should i disable cups till theres a fix?

Is the network connect to the Web?
If its just a private netwok Isolated from others your most likely safe.

 

[tinfoil-hat]

Is the network connect to the Web?
If its just a private netwok Isolated from others your most likely safe.

I've got some portforwarding

 

[ron.alan]

I have cups, but cups-browsed is not installed. I guess I'm not affected then?

 

[kc1di]

I've got some portforwarding

in that case I would heed @f33dm3bits advice above.

 

[kc1di]

I have cups, but cups-browsed is not installed. I guess I'm not affected then?

Your safe , On this one anyway

 

[CaffeineAddict]

I've got some portforwarding

Then you're affected according to redhat link from post #2
That is, if you open port to to cups-browsed service.

 

[ron.alan]

Question: If a Linux system has ufw (the firewall) running with incoming set to "Deny," does this not keep the system safe from this vulnerability? I'm getting into a debate with someone over on another forum over this question. It seems to me that the firewall would keep the system safe. Am I wrong?

 

[CaffeineAddict]

Question: If a Linux system has ufw (the firewall) running with incoming set to "Deny," does this not keep the system safe from this vulnerability? I'm getting into a debate with someone over on another forum over this question. It seems to me that the firewall would keep the system safe. Am I wrong?

I think firewall will keep you safe unless it allows inbound inbound to cups-browser service.

An attacker has access to a vulnerable server, which :

1. Allows unrestricted access, such as the public internet

If you block inbound then the attacker has no unrestricted access.

Assuming redhat's description is correct then no, it can't.

Keep in mind that mDNS (avahi daemon) however could also contribute to discovery of a printer, this is not stated.
Perhaps it's worth seeing how cups-browser service works and whether your firewall allows outbound mDNS, in which case it would also allow inbound.

Also I think mDNS is stateless so firewall stateful rules might have no effect.