Latest OpenPrinting CUPS vulnerabilities #
Several security advisories were published today for OpenPrinting Common UNIX Printing System (CUPS) components. OpenPrinting CUPS is the most widely adopted printing system on both Linux and Unix-derived operating systems.
- CVE-2024-47076 found in libcupsfilters is rated high with CVSS score of 8.6, and does not sanitize user-submitted data.
- CVE-2024-47175 found in libppd is rated high with CVSS score of 8.6 and does not sanitize user-submitted data.
- CVE-2024-47176 found in cups-browsed is rated high with CVSS score of 8.3, and allows a remote attacker to register rogue printers.
- CVE-2024-47177 found in cups-filters is rated critical with CVSS score of 9.0, and potentially allows for remote code execution.
What is the impact? #
When the bugs are chained together, an exploit potentially allows remote code execution by an attacker against vulnerable systems. To successfully exploit a vulnerable system, the cups-browsed daemon must be enabled and listening on UDP/631, which according to some vendors is disabled by default. If enabled, an attacker then needs to trick a user into printing from a spoofed, malicious print server that is advertised over the local network.
Are updates or workarounds available? #
While no known patches are available at this time, vendors are advising that administrators verify that the cups-browsed daemon is not running on any Linux or UNIX systems in their environment.
Although all versions of RedHat are affected, they have lowered the rating to Important since systems running their default configuration are unaffected.
How to find potentially vulnerable systems with runZero #
On September 26th, we released a CUPS (IPP) Browser protocol probe that is enabled on new scans by default. To ensure that the runZero explorer is scanning your network for potentially vulnerable systems, make sure that the IPP-BROWSE UDP probe is enabled for new scans. If the probe is enabled, from the Asset Inventory you can use the following query to locate potentially vulnerable systems:
protocol:ipp-browse has:ippBrowse.userAgent
