Experts warn of DDoS attacks using linux printing vulnerability
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2024-47076 | Unsanitized IPP attribute injection in OpenPrinting libcupsfilters (CWE-20) OpenPrinting's libcupsfilters, the library providing CUPS filter functionality for printer data-format conversion, fails to sanitize IPP attributes returned from IPP servers in its cfGetPrinterAttributes5 function (CWE-20, CVSS 8.6). The flaw is triggered when a system running CUPS contacts an attacker-controlled or untrusted IPP server and uses the returned attributes, for example to generate a PPD file, allowing attacker-controlled data to flow into the rest of the CUPS system. On its own this yields high-integrity attacker data injection (per the CVSS vector, no direct confidentiality or availability loss), but it is one of several CUPS flaws disclosed together in late September 2024 that, when chained under certain conditions, can result in remote code execution on Linux and Unix systems. Any system running libcupsfilters is affected; CUPS and its filter libraries ship by default with most major Linux distributions, and public internet scans around disclosure found roughly 75,000 hosts exposing the IPP service (TCP 631) directly to the internet. Proof-of-concept details are public (an EvilSocket writeup and the OpenPrinting GitHub advisory GHSA-w63j-6g73-wmg5), the flaw is not yet in CISA KEV, and EPSS assigns a 77.6% probability of exploitation within 30 days, though no confirmed in-the-wild exploitation appears in the provided data. Do: Upgrade libcupsfilters to the patched release identified in the OpenPrinting advisory GHSA-w63j-6g73-wmg5 (fixed in libcupsfilters 2.1.0), applying your distribution's updated cups-filters/CUPS packages; also install the companion CUPS component fixes released the same week, since this flaw is typically chained with other CUPS bugs (notably in cups-browsed) for remote code execution. Until patched, restrict or disable exposure of the IPP service (TCP 631) to untrusted networks and avoid creating or refreshing printer queues from untrusted or mDNS-advertised IPP servers. | 8.6 | 78% | PoC ×2 |
| masstens of millions of Linux/Unix systems ship the vulnerable library; ~75,000 hosts expose IPP (TCP 631) directly to the internet per public scans | |
| CVE-2024-47175 | Unsanitized IPP input in OpenPrinting libppd enables RCE chain on Linux CUPS CVE-2024-47175 is an improper input validation flaw (CWE-20) in OpenPrinting's libppd: the ppdCreatePPDFromIPP2 function fails to sanitize IPP attributes when writing them into a generated PPD buffer. When this unsanitized, attacker-controlled input flows through the CUPS print pipeline — for example via the cups-browsed entry point abused in CVE-2024-47176, in combination with functions such as cfGetPrinterAttributes5 — it can ultimately be executed by Foomatic print filters, giving remote code execution. Affected systems are Linux/Unix hosts running the CUPS printing stack with vulnerable libppd components, which includes widely used distributions such as Debian and, per press coverage, most other major Linux distros. Exploitation status: public proofs of concept and researcher write-ups exist, the flaw carries a high EPSS score (63.6% probability of exploitation within 30 days, 99th percentile) and warnings about abuse including DDoS, but it is not yet in CISA's KEV catalog, so no confirmed widespread in-the-wild exploitation is documented in the available data. Do: Install your distribution's security updates — upgrade libppd to the patched release (2.1b1 or later, per the OpenPrinting advisory GHSA-7xfx-47qg-grp6) and apply the matching cups/cups-filters fixes. As interim mitigation, disable or stop cups-browsed if not needed and block or restrict inbound UDP 631 (and IPP/port 631 generally) from untrusted networks, particularly on internet-facing hosts. Check whether CUPS is running and reachable on your systems and whether configured printers rely on Foomatic filters, which the RCE chain requires. | 9.8 | 64% | PoC ×2 |
| largetens of thousands of internet-exposed CUPS hosts (roughly 75,000 per public internet-wide scans at disclosure), on top of a far larger install base of Linux… | |
| CVE-2024-47176 | Unauthenticated RCE chain in OpenPrinting cups-browsed (CVE-2024-47176) CVE-2024-47176 is a flaw in cups-browsed, the network printer auto-discovery component of the OpenPrinting CUPS printing stack shipped with most major Linux and Unix distributions, which binds to UDP port 631 on all interfaces (INADDR_ANY) and therefore accepts and trusts unauthenticated packets from any source. A remote attacker can send a crafted browse/IPP packet that makes cups-browsed issue a Get-Printer-Attributes IPP request to an attacker-controlled URL. On its own this flaw is rated Medium (5.3), but chained with companion flaws in libcupsfilters (CVE-2024-47076), libppd (CVE-2024-47175), and cups-filters (CVE-2024-47177) it enables unauthenticated arbitrary command execution when a user prints to the attacker's malicious printer; the exposure has also been noted as abusable for DDoS amplification. Any Linux/Unix system running cups-browsed with UDP/631 reachable from an untrusted network is affected. No confirmed widespread in-the-wild exploitation has been reported and the flaw is not yet in CISA's KEV, but public proofs of concept exist and EPSS assigns a ~51% probability of exploitation within 30 days (99th percentile). Do: Update cups-browsed and the companion cups-filters/libcupsfilters/libppd packages to the patched releases published by OpenPrinting and your distribution alongside the September 2024 advisories (see GHSA-rj88-6mr5-rcw8). If patched packages are not yet available, stop or disable the cups-browsed service, or firewall inbound UDP port 631 from untrusted networks and ensure it binds only to localhost where network printer discovery is not needed. Audit whether cups-browsed is running and whether UDP/631 is reachable from the internet, and treat any network-reachable CUPS host as a candidate for the full RCE chain. | 5.3 | 51% | PoC ×2 |
| massmillions of Linux/Unix installations (cups-browsed ships in the default print stack of major distributions), of which only on the order of tens of thousands of… | |
| CVE-2024-47177 | Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2024-47076, CVE-2024-47175, CVE-2024-47176. Reason: This candidate is a duplicate of CVE-2024-47076, CVE-2024-47175, and CVE-2024-47176. Notes: All CVE users should reference CVE-2024-47076, CVE-2024-47175, and/or CVE-2024-47176 instead of this candidate. This CVE was issued to a vulnerability that is dependent on CVE-2024-47076, CVE-2024-47175, and CVE-2024-47176. According to rule 4.2.15 of the CVE CNA rules, \"CNAs MUST NOT assign a different CVE ID to a Vulnerability that is fully interdependent with another Vulnerability. The Vulnerabilities are effectively the same single Vulnerability and MUST use one CVE ID. NVD description · AI analysis pending | — | — | — | — |
Full article836 words · extracted from therecord.media · click to collapse
A set of bugs that has caused alarm among cybersecurity experts may enable threat actors to launch powerful attacks designed to knock systems offline. Researchers at technology firm Akamai said on Tuesday that distributed denial-of-service (DDoS) attacks could be launched using four vulnerabilities affecting Common UNIX Printing System, also known as CUPS. The vulnerabilities, which allow attackers to run malicious code on a remote device, were discovered by Italian security researcher Simone Margaritelli and disclosed last week. CUPS allows printing on many Linux-based systems and the four bugs help attackers to potentially change that service and trick users into running malicious code. CUPS comes with all Linux operating systems, most BSD systems and some Apple and Android-based computers, according to OpenSSF Technical Advisory Council chair Christopher Robinson. The four vulnerabilities are CVE-2024-47176, CVE-2024-47076, CVE-2024-47175, and CVE-2024-47177. Larry Cashdollar, principal security researcher at Akamai, said he was going through Margaritelli’s technical write-up about the four CUPS vulnerabilities when he discovered another attack vector was not discussed: DDoS. “DDoS continues to be a viable attack vector used to harass and disrupt victims across the internet, from major industries and governments to small content creators, online shops, and gamers,” he said. “The problem arises when an attacker sends a crafted packet specifying the address of a target as a printer to be added. For each packet sent, the vulnerable CUPS server will generate a larger and partially attacker-controlled IPP/HTTP request directed at the specified target. As a result, not only is the target affected, but the host of the CUPS server also becomes a victim, as the attack consumes its network bandwidth and CPU resources.” Akamai’s Security Intelligence and Response Team (SIRT) said they found that more than 198,000 devices are vulnerable to this attack vector and are accessible on the public internet. About 34% — more than 58,000 — could be used for DDoS abuse. There was significant controversy about the disclosure of the bugs, with Margaritelli writing on social media site X that the team behind CUPS was using its “energies to explain to the poor bastard that reported them how wrong he is, even tho he’s literally giving you [Proof of Concept] after [Proof of Concept] and systematically proving your assumptions about your own software wrong at every comment.” “This is just insane,” he added. The initial concerns about the CUPS vulnerabilities were tempered when experts noted that remediation was fairly simple and exploitation is only available in a limited number of scenarios. Experts said people should simply update, remove or disable CUPS to protect themselves. Benjamin Harris, CEO of cybersecurity firm watchTowr, said CUPS itself is the software that handles printing on a Linux machine, and thus, by virtue of Linux not being a 'desktop' operating system in many environments in the same way that you'd see Windows, the impact and scope of the bugs is reduced. “That being said, if you are using a desktop edition of Linux (say Ubuntu Desktop and for example, developers) – there is a good chance you have CUPS installed, but whether it is turned on in a vulnerable state is harder to predict,” Harris explained. He added that the vulnerabilities impact less than a single-digit percentage of all deployed internet-facing Linux systems. But Cashdollar said the limited resources required to initiate a successful attack highlights the danger. “It would take an attacker mere seconds to co-opt every vulnerable CUPS service currently exposed on the internet,” he wrote. To begin the attack, Akamai claimed a threat actor would only have to send one packet to a vulnerable and exposed CUPS service with internet connectivity. A packet is a small segment of a larger message and data sent over computer networks is divided into packets. “For each packet sent by a bad actor, the vulnerable CUPS server will generate a larger and partially attacker-controlled IPP/HTTP request directed at the specified target,” Akamai said. “As a result, not only is the target affected, but the host of the CUPS server also becomes a victim, as the attack consumes its network bandwidth and CPU resources.” The researchers noted that many of the identified machines are running older versions of CUPS dating back to 2007, giving threat actors prime real estate to exploit the bugs. Risky Biz reported this week that threat actors are scanning the internet for UNIX systems that are exposing their printing ports in an effort to abuse the CUPS bugs. Several experts, including OpenSSF’s Robinson, said the situation highlighted the need for organizations to have a better understanding of what services are running on their systems. If something isn't being actively used, it should be shut off, he said. CUPS dating back to 2007
No previous article
No new articles
Jonathan Greig
is a Breaking News Reporter at Recorded Future News. Jonathan has worked across the globe as a journalist since 2014. Before moving back to New York City, he worked for news outlets in South Africa, Jordan and Cambodia. He previously covered cybersecurity at ZDNet and TechRepublic.
Text extracted automatically; images, tables and formatting may be missing. Original: https://therecord.media/ddos-attacks-cups-linux-print-vulnerability