This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.

[TLP:CLEAR] CUPS vulnerabilities allow remote command execution

CUPS and related components (cups-browsed, libcupsfilters, libppd, cups-filters) from OpenPrinting are affected by 4 vulnerabilities, which are critically severe if exploited as a chain [1]. Although the affected components are present on most popular UNIX systems [1], in the default configuration they are enabled only on some of them - Ubuntu version 24.04 is confirmed, but it can be expected that other versions are affected too, and the same cannot be ruled out for other UNIX systems. The first precondition for exploiting the vulnerabilities is the "cups-browsed" service listening on port 631 of the affected device over the UDP protocol, which can be verified with the command "lsof -i :631" [1]. An official fix from the developers is not yet available. As a temporary fix, the "cups-browsed" service can be disabled/removed, or, if the system needs this service, any incoming UDP traffic to port 631 can be blocked [1]. For operating system updates, fixing the vulnerability CVE-2024-47176 should suffice to prevent a remote attacker from executing commands in the OS; nevertheless, the remaining vulnerabilities also pose a security risk, so we strongly recommend updating the individual components to a version in which all the vulnerabilities are fixed as soon as possible. Individual distributions and their fixed versions: Ubuntu [2][3][4][5]: noble: cups - 2.4.7-1.2ubuntu7.3, libppd - 2:2.0.0-0ubuntu4.1, libcupsfilters - 2.0.0-0ubuntu7.1, cups-browsed - 2.0.0-0ubuntu10.1 jammy: cups - 2.4.1op1-1ubuntu4.11, cups-filters - 1.28.15-0ubuntu1.3, focal: cups - 2.3.1-9ubunt:u1.9, cups-filters - 1.27.4-1ubuntu0.3 Debian [6][7][8][8]: bullseye (security): cups - 2.3.3op2-3+deb11u9, cups-filters - 1.28.7-1+deb11u3 bookworm (security): cups - 2.4.2-3+deb12u8, cups-filters - 1.28.17-3+deb12u1

CUPS - RCE (CVE-2024-47176, CVE-2024-47076, CVE-2024-47175, CVE-2024-47177)
CVSS 8.3 (High)

An unauthenticated remote attacker can, by chaining 4 vulnerabilities, execute arbitrary commands on the affected device's system with the privileges of the CUPS process [1][9]. Details of the individual vulnerabilities can be found at [1]. PoCs have been published for the vulnerabilities [10][11]. Exploitation of the vulnerabilities requires victim interaction: the victim must send a print job to the attacker's server posing as a printer [1][9].

The vulnerability is present in products:

  • cups-browsed; <= 2.0.1;
  • libcupsfilters; <= 2.1b1;
  • libppd; <= 2.1b1;
  • cups-filters; <= 2.0.1;

CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 26. 9. 2024.

By CESNET, z.s.p.o. Martin Krajči on 1. 10. 2024.

CESNET, z.s.p.o. Logo