Critical RCE Vulnerabilities Found in Common Unix Printing System
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2024-47076 | Unsanitized IPP attribute injection in OpenPrinting libcupsfilters (CWE-20) OpenPrinting's libcupsfilters, the library providing CUPS filter functionality for printer data-format conversion, fails to sanitize IPP attributes returned from IPP servers in its cfGetPrinterAttributes5 function (CWE-20, CVSS 8.6). The flaw is triggered when a system running CUPS contacts an attacker-controlled or untrusted IPP server and uses the returned attributes, for example to generate a PPD file, allowing attacker-controlled data to flow into the rest of the CUPS system. On its own this yields high-integrity attacker data injection (per the CVSS vector, no direct confidentiality or availability loss), but it is one of several CUPS flaws disclosed together in late September 2024 that, when chained under certain conditions, can result in remote code execution on Linux and Unix systems. Any system running libcupsfilters is affected; CUPS and its filter libraries ship by default with most major Linux distributions, and public internet scans around disclosure found roughly 75,000 hosts exposing the IPP service (TCP 631) directly to the internet. Proof-of-concept details are public (an EvilSocket writeup and the OpenPrinting GitHub advisory GHSA-w63j-6g73-wmg5), the flaw is not yet in CISA KEV, and EPSS assigns a 77.6% probability of exploitation within 30 days, though no confirmed in-the-wild exploitation appears in the provided data. Do: Upgrade libcupsfilters to the patched release identified in the OpenPrinting advisory GHSA-w63j-6g73-wmg5 (fixed in libcupsfilters 2.1.0), applying your distribution's updated cups-filters/CUPS packages; also install the companion CUPS component fixes released the same week, since this flaw is typically chained with other CUPS bugs (notably in cups-browsed) for remote code execution. Until patched, restrict or disable exposure of the IPP service (TCP 631) to untrusted networks and avoid creating or refreshing printer queues from untrusted or mDNS-advertised IPP servers. | 8.6 | 78% | PoC ×2 |
| masstens of millions of Linux/Unix systems ship the vulnerable library; ~75,000 hosts expose IPP (TCP 631) directly to the internet per public scans | |
| CVE-2024-47176 | Unauthenticated RCE chain in OpenPrinting cups-browsed (CVE-2024-47176) CVE-2024-47176 is a flaw in cups-browsed, the network printer auto-discovery component of the OpenPrinting CUPS printing stack shipped with most major Linux and Unix distributions, which binds to UDP port 631 on all interfaces (INADDR_ANY) and therefore accepts and trusts unauthenticated packets from any source. A remote attacker can send a crafted browse/IPP packet that makes cups-browsed issue a Get-Printer-Attributes IPP request to an attacker-controlled URL. On its own this flaw is rated Medium (5.3), but chained with companion flaws in libcupsfilters (CVE-2024-47076), libppd (CVE-2024-47175), and cups-filters (CVE-2024-47177) it enables unauthenticated arbitrary command execution when a user prints to the attacker's malicious printer; the exposure has also been noted as abusable for DDoS amplification. Any Linux/Unix system running cups-browsed with UDP/631 reachable from an untrusted network is affected. No confirmed widespread in-the-wild exploitation has been reported and the flaw is not yet in CISA's KEV, but public proofs of concept exist and EPSS assigns a ~51% probability of exploitation within 30 days (99th percentile). Do: Update cups-browsed and the companion cups-filters/libcupsfilters/libppd packages to the patched releases published by OpenPrinting and your distribution alongside the September 2024 advisories (see GHSA-rj88-6mr5-rcw8). If patched packages are not yet available, stop or disable the cups-browsed service, or firewall inbound UDP port 631 from untrusted networks and ensure it binds only to localhost where network printer discovery is not needed. Audit whether cups-browsed is running and whether UDP/631 is reachable from the internet, and treat any network-reachable CUPS host as a candidate for the full RCE chain. | 5.3 | 51% | PoC ×2 |
| massmillions of Linux/Unix installations (cups-browsed ships in the default print stack of major distributions), of which only on the order of tens of thousands of… |
Full article434 words · extracted from infosecurity-magazine.com · click to collapse
A new set of remote code execution (RCE) vulnerabilities affecting the Common Unix Printing System (CUPS) in Linux environments has been discovered.
These flaws, rated with a critical CVSS score of 9.9, allow attackers to execute arbitrary code on systems without requiring authentication.
The vulnerabilities, impacting all versions of Enterprise Linux, have been confirmed in Ubuntu Linux 24.04.1, and potentially affect any system running the cups-browsed component.
Security researchers identified the vulnerabilities in CUPS, which handles network printing on Linux and other Unix-based systems. The flaws exploit improper input validation when managing printer requests over the network, particularly through UDP port 631.
By sending a malicious print job from a device they control, attackers can trick the system into installing a compromised printer driver, allowing code execution with the privileges of the lP user.
Systems at Risk
The following systems are affected by this vulnerability:
- Linux servers and desktops running CUPS or cups-browsed
- NAS or VOIP servers that have CUPS installed by default
- Internet-of-Things (IoT) devices configured with CUPS printing services
Although the lP user is not a superuser, various researchers confirmed attackers could use this access to escalate their privileges and infiltrate other parts of the network.
This is a serious concern for enterprises and organizations relying on Linux systems for mission-critical operations.
The vulnerability is particularly concerning as it could be exploited in automated internet-wide scans. Once compromised, attackers could install remote access Trojans (RATs) to maintain control even after patches are applied.
Attack Vector and Exploit Potential
For an attacker to successfully exploit this vulnerability, they would need access to the target system's local network or bypass its firewall protections through a misconfigured firewall rule.
This is uncommon in properly secured environments but remains a significant threat to devices connected to unsecured public networks.
CVE-2024-47176, CVE-2024-47076 and other associated vulnerabilities allow attackers to craft UDP packets directed at the CUPS service, exploiting its inadequate validation of print attributes.
Organizations should take immediate action to assess the exposure of their systems and implement the recommended security measures to mitigate this critical risk.
Mitigation Strategies
To mitigate the risk, security professionals are urged to take the following steps:
- Patch immediately: Apply security updates for CUPS as soon as they are available
- Disable CUPS: If printing services are not required, disable CUPS entirely
- Restrict network access: Block UDP port 631 at the firewall level to prevent unauthorized access
- Update configuration: Add “BrowseDeny All” to the CUPS configuration file to prevent remote printer discovery
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.infosecurity-magazine.com/news/rce-vulnerabilities-cups/