{"id":119956,"date":"2024-09-27T09:43:04","date_gmt":"2024-09-27T07:43:04","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/udalyonno-ekspluatiruemye-uyazvimosti-v-servere-pechati-cups"},"modified":"2024-09-27T09:43:04","modified_gmt":"2024-09-27T07:43:04","slug":"udalyonno-ekspluatiruemye-uyazvimosti-v-servere-pechati-cups","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hu\/blog\/news\/udalyonno-ekspluatiruemye-uyazvimosti-v-servere-pechati-cups","title":{"rendered":"Remotely exploitable vulnerabilities in the CUPS print server","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Simone Margaritelli, az OpenSnitch t\u0171zfal \u00e9s a bettercap h\u00e1l\u00f3zatelemz\u0151 szerz\u0151je, el\u0151re bejelentette a kor\u00e1bban bejelentett kritikus sebezhet\u0151s\u00e9geket, amelyek lehet\u0151v\u00e9 teszik a GNU\/Linux, Solaris, FreeBSD \u00e9s n\u00e9h\u00e1ny m\u00e1s BSD-disztrib\u00faci\u00f3 t\u00e1voli t\u00e1mad\u00e1s\u00e1t. Eredetileg a publik\u00e1l\u00e1s okt\u00f3ber 6-\u00e1ra volt tervezve, de az inform\u00e1ci\u00f3 kisziv\u00e1rg\u00e1sa miatt azt el\u0151re kellett hozni, miel\u0151tt a legt\u00f6bb disztrib\u00faci\u00f3 fel tudta volna k\u00e9sz\u00edteni a csomagfriss\u00edt\u00e9seket. A sebezhet\u0151s\u00e9gek a CUPS nyomtat\u00f3szervereket \u00e9rintik, \u00e9s lehet\u0151v\u00e9 teszik a k\u00f3d v\u00e9grehajt\u00e1s\u00e1t a rendszerben hiteles\u00edt\u00e9s n\u00e9lk\u00fcl. <\/p>\n

A researcher who identified the problem has prepared a working exploit prototype that uses a combination of several vulnerabilities, allowing remote code execution with the privileges of the CUPS print job processing user (typically the user «lp»). The exploit enables the stealthy replacement of user printer parameters or the addition of a new printer linked to an attacker-operated IPP server that provides a specially crafted printer PPD description. The processing of this PPD during the initiation of a print job leads to the execution of the attacker's code (it is necessary for the victim to initiate printing to the substituted or replaced printer by the attacker). <\/p>\n

A t\u00e1mad\u00e1sra fog\u00e9kony rendszerek a szerverrel<\/a> CUPS nyomtat\u00e1skezel\u0151vel \u00e9s a cups-browsed folyamattal rendelkeznek, amely a 631-es porton (UDP) fogadja a h\u00e1l\u00f3zati kapcsolatokat. A t\u00e1mad\u00e1s lok\u00e1lis h\u00e1l\u00f3zatb\u00f3l is v\u00e9grehajthat\u00f3, ahol a nyomtat\u00e1s sor\u00e1n a szerverhez<\/a> Printing protocols such as zeroconf, mDNS, or DNS-SD are used. Only configurations of cups-browsed are vulnerable where the value «cups» is specified in the BrowseRemoteProtocols parameter in the file \/etc\/cups\/cups-browsed.conf. In distributions with systemd, you can check the usage of the cups-browsed service with the command «sudo systemctl status cups-browsed». <\/p>\n

The vulnerability is present in all CUPS-based printing systems that use vulnerable versions of the cups-filters, libcupsfilters, libppd, and cups-browsed packages. Fixes are currently available only in the form of patches (1, 2, 3) \u2014 the current versions cups-filters 2.0.1, libcupsfilters 2.1b1, libppd 2.1b1, and cups-browsed 2.0.1 are vulnerable. The issue remains unaddressed in distributions; you can track the release of updates on the following pages: Debian, Ubuntu, RHEL, SUSE\/openSUSE, Fedora, Arch, FreeBSD. As a workaround for protection until the update is installed, access to UDP port 631 can be restricted from external networks, the cups-browsed service can be disabled, or the BrowseRemoteProtocols setting can be set to «none». <\/p>\n

Felt\u00e1rt sebezhet\u0151s\u00e9gek: <\/p>\n