Latest OpenPrinting CUPS vulnerabilities #

Several security advisories were published today for OpenPrinting Common UNIX Printing System (CUPS) components. OpenPrinting CUPS is the most widely adopted printing system on both Linux and Unix-derived operating systems. 

  • CVE-2024-47076 found in libcupsfilters is rated high with CVSS score of 8.6, and does not sanitize user-submitted data.
  • CVE-2024-47175 found in libppd is rated high with CVSS score of 8.6 and does not sanitize user-submitted data.
  • CVE-2024-47176 found in cups-browsed is rated high with CVSS score of 8.3, and allows a remote attacker to register rogue printers.
  • CVE-2024-47177 found in cups-filters is rated critical with CVSS score of 9.0, and potentially allows for remote code execution.

What is the impact? #

When the bugs are chained together, an exploit potentially allows remote code execution by an attacker against vulnerable systems. To successfully exploit a vulnerable system, the cups-browsed daemon must be enabled and listening on UDP/631, which according to some vendors is disabled by default. If enabled, an attacker then needs to trick a user into printing from a spoofed, malicious print server that is advertised over the local network.

Are updates or workarounds available? #

While no known patches are available at this time, vendors are advising that administrators verify that the cups-browsed daemon is not running on any Linux or UNIX systems in their environment. 

Although all versions of RedHat are affected, they have lowered the rating to Important since systems running their default configuration are unaffected.

How to find potentially vulnerable systems with runZero #

On September 26th, we released a CUPS (IPP) Browser protocol probe that is enabled on new scans by default. To ensure that the runZero explorer is scanning your network for potentially vulnerable systems, make sure that the IPP-BROWSE UDP probe is enabled for new scans. If the probe is enabled, from the Asset Inventory you can use the following query to locate potentially vulnerable systems:

protocol:ipp-browse has:ippBrowse.userAgent

Written by runZero Team

Due to the nature of their research and out of respect for their privacy, runZero team members prefer to remain anonymous. Their work is published under the runZero name.

More about runZero Team
Subscribe Now

Get the latest news and expert insights delivered in your inbox.

Welcome to the club! Your subscription to our newsletter is successful.


Related Articles

Rapid Response
How to find SuperMicro BMCs
Supermicro released a vulnerability advisory for a critical CVE that allows for remote code execution (CVE-2024-36435). Here's how to find impacted...
Rapid Response
How to find Advantech ADAM devices on your network
Advantech has disclosed multiple vulnerabilities in their ADAM 5000 series Ethernet I/O modules. Here's how to find them on your network.
Rapid Response
How to find XenServer and Citrix Hypervisor on your network
A new vulnerability was disclosed in XenServer 8 and Citrix Hypervisor 8.2 CU1 LTSR. Here's how to find affected systems with runZero.
Rapid Response
How to find VMware vCenter assets on your network
Broadcom has issued a security advisory for two vulnerabilities in VMware vCenter. Here's how to find potentially vulnerable assets with runZero.

See Results in Minutes

Get complete visibility into IT, OT, & IoT — without agents, credentials, or hardware.

© Copyright 2024 runZero, Inc. All Rights Reserved