September 26, 2024 at 06:09PM
Attackers can exploit multiple vulnerabilities in the CUPS open-source printing system (CVE-2024-47076, CVE-2024-47175, CVE-2024-47176, CVE-2024-47177) discovered by Simone Margaritelli to execute remote code. The cups-browsed daemon, when enabled, can be exploited to automatically install a malicious printer, but mitigations such as disabling the service are available. Red Hat has rated the flaws as “Important” but not critical.
Here are the key takeaways from the meeting notes:
1. A series of vulnerabilities in the CUPS open-source printing system, tracked as CVE-2024-47076, CVE-2024-47175, CVE-2024-47176, and CVE-2024-47177, were discovered by Simone Margaritelli. These security flaws can lead to remote code execution under specific conditions, particularly in the cups-browsed component.
2. The cups-browsed daemon, which is part of the CUPS system, searches the local network for shared printers and makes them available for printing on the machine.
3. Margaritelli found that a malicious PostScript Printer Description (PPD) printer could be created and advertised to an exposed cups-browsed service on UDP port 631, potentially leading to remote code execution if a user prints to the malicious printer.
4. Attackers need to overcome several obstacles to exploit these vulnerabilities, such as having the cups-browsed daemon enabled and tricking a user into printing from a malicious printer on their local network. This mitigates the real-world impact of the vulnerabilities.
5. Red Hat has rated the flaws as “Important” rather than critical due to these mitigations and the limited world impact.
6. While patches are still in development, mitigation measures have been shared by Red Hat, including stopping the cups-browsed service from running and preventing it from starting on reboot. Users can use specific commands to check if the cups-browsed service is running on their systems.
It is important to note that while patches are still under development, mitigation measures have been provided to address the vulnerabilities.