{"id":119956,"date":"2024-09-27T09:43:04","date_gmt":"2024-09-27T07:43:04","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/udalyonno-ekspluatiruemye-uyazvimosti-v-servere-pechati-cups"},"modified":"2024-09-27T09:43:04","modified_gmt":"2024-09-27T07:43:04","slug":"udalyonno-ekspluatiruemye-uyazvimosti-v-servere-pechati-cups","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/udalyonno-ekspluatiruemye-uyazvimosti-v-servere-pechati-cups","title":{"rendered":"Remote exploitation vulnerabilities in the CUPS print server","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Simone Margaritelli, the author of the OpenSnitch firewall and the bettercap network analyzer, prematurely disclosed information about previously announced critical vulnerabilities that allow remote attacks on the GNU\/Linux, Solaris, FreeBSD distributions and some other BSD systems. The publication was initially scheduled for October 6, but due to a leak of information, it had to be released earlier, before most distributions could prepare their package updates. The vulnerabilities affect the CUPS print server and allow remote code execution in the system without authentication. <\/p>\n

The researcher who identified the problem has prepared a working prototype of an exploit that uses a combination of several vulnerabilities, allowing for remote code execution with the print job processing privileges of the CUPS service (typically using the user 'lp'). The exploit enables stealthy modification of the user's printer settings or the addition of a new printer linked to a malicious IPP server, which delivers a specially crafted printer PPD description. Processing this PPD when initiating a print job leads to the execution of the attacker's code (the victim must initiate printing on the substituted or altered printer). <\/p>\n

Systems with proxy server<\/a> CUPS printing and a running cups-browsed process that accepts network connections on port 631 (UDP) are vulnerable. The attack can also be executed from a local network where protocols such as server<\/a> Printing utilizes the zeroconf, mDNS, or DNS-SD protocols. Only configurations of cups-browsed where the BrowseRemoteProtocols setting in the \/etc\/cups\/cups-browsed.conf file is set to 'cups' are vulnerable. In distributions with systemd, the status of the cups-browsed service can be checked with the command 'sudo systemctl status cups-browsed'. <\/p>\n

The vulnerability affects all CUPS-based printing systems that use vulnerable versions of the cups-filters, libcupsfilters, libppd, and cups-browsed packages. Fixes are currently available only as patches (1, 2, 3) \u2014 the current versions cups-filters 2.0.1, libcupsfilters 2.1b1, libppd 2.1b1, and cups-browsed 2.0.1 are vulnerable. In many distributions, the issue remains unpatched, and updates can be tracked on the following pages: Debian, Ubuntu, RHEL, SUSE\/openSUSE, Fedora, Arch, FreeBSD. As a temporary protection measure until an update is applied, access to UDP port 631 from external networks can be restricted, the cups-browsed service can be disabled, or the BrowseRemoteProtocols setting can be set to 'none'. <\/p>\n

Identified vulnerabilities: <\/p>\n