[ad_1]
Beneath sure situations, attackers can chain a set of vulnerabilities in a number of parts of the CUPS open-source printing system to execute arbitrary code remotely on weak machines.
Tracked as CVE-2024-47076 (libcupsfilters), CVE-2024-47175 (libppd), CVE-2024-47176 (cups-browsed) and CVE-2024-47177 (cups-filters) and found by Simone Margaritelli, these safety flaws do not have an effect on methods of their default configuration.
CUPS (quick for Frequent UNIX Printing System) is essentially the most extensively used printing system on Linux methods, and it is usually typically supported on units working Unix-like working methods similar to FreeBSD, NetBSD, and OpenBSD and their derivates.
Considered one of its parts is the cups-browsed daemon, which searches the native community for marketed community or shared printers and makes them out there for printing on the machine. That is just like how Home windows and Macs can search the community for distant community printers to print to.
Margaritelli discovered that if the cups-browsed daemon is enabled, which isn’t on most methods, it can hear on UDP port 631. It would additionally, by default, permit distant connections from any system on the community to create a brand new printer.
He found he might create a malicious PostScript Printer Description (PPD) printer that could possibly be manually marketed to an uncovered cups-browsed service working on UDP port 631.
This causes the distant machine to mechanically set up the malicious printer and make it out there for printing. If the consumer on that uncovered server prints to the brand new printer, the malicious command within the PPD shall be executed regionally on the pc.
The command to execute when printing is added by way of a foomatic-rip filter, which executes instructions on a tool so {that a} print job is rendered accurately.
Restricted world affect
Whereas this can be a distant code execution chain, it needs to be famous from the beginning that attackers should overcome some obstacles to use the vulnerabilities and truly obtain distant code execution.
The primary is that the focused methods will need to have the cups-browsed daemon enabled, which is often not enabled by default, to show their UDP ports on a community. Then, the attacker has to trick a consumer into printing from a malicious printer server on their native community that instantly seems on their machine.
“It’s a chain of bugs that depend on spoofing a printer in your native community that’s mechanically added through community discovery whether it is turned on in any respect – often not in its default configuration. Then an unverified variable that’s used to use different vulnerabilities within the CUPS system to execute code, however solely when a print job is triggered,” stated Ilkka Turunen, Subject CTO at Sonatype.
“Excellent news then – it’s an RCE however with a number of mitigations, together with the very fact the attacker wants to have the ability to hook up with a pc through UDP which is extensively disabled on community ingress and the service is often not on by default. It looks as if the true world affect is low.”
For these causes, Pink Hat has rated the failings as having an “Essential” severity affect as an alternative of essential.
Whereas BleepingComputer’s exams confirmed that the majority of our Linux servers didn’t have the service enabled by default, one in all our Ubuntu VMs did. Others have additionally famous on Twitter that cups-browsed was enabled by default on their Linux units.
No patches, however mitigation measures can be found
Whereas patches are nonetheless in improvement, Pink Hat shared mitigation measures requiring admins to cease the cups-browsed service from working and forestall it from being began on reboot utilizing the next instructions to interrupt the exploit chain:
sudo systemctl cease cups-browsed
sudo systemctl disable cups-browsed
Pink Hat customers may use the next command to search out out if cups-browsed is working on their methods:
sudo systemctl standing cups-browsed
If the consequence shows “Lively: inactive (useless),” then the exploit chain is halted, and the system is just not weak. If the consequence exhibits “working” or “enabled,” and the “BrowseRemoteProtocols” directive accommodates the worth “cups” within the configuration file /and many others/cups/cups-browsed.conf, then the system is weak.
[ad_2]
