A new set of security vulnerabilities has been disclosed in the OpenPrinting Common Unix Printing System (CUPS) on Linux systems that could permit remote command execution under specific conditions.
"A remote unauthenticated attacker can silently replace existing printers' (or install new ones) IPP URLs with a malicious one, resulting in arbitrary command execution (on the computer) when a print job is started (from that computer)," said security researcher Simone Margaritelli.
CUPS is a standards-based, open-source printing system for Linux and other Unix-like operating systems, including ArchLinux, Debian, Fedora, Red Hat Enterprise Linux (RHEL), ChromeOS, FreeBSD, NetBSD, OpenBSD, openSUSE, and SUSE Linux.
The list of vulnerabilities is as follows:
- CVE-2024-47176: cups-browsed <= 2.0.1 binds on UDP INADDR_ANY:631, trusting any packet from any source to trigger a Get-Printer-Attributes IPP request to an attacker-controlled URL.
- CVE-2024-47076: libcupsfilters <= 2.1b1 cfGetPrinterAttributes5 does not validate or sanitize the IPP attributes returned from an IPP server, allowing attacker-controlled data to flow through the CUPS system.
- CVE-2024-47175: libppd <= 2.1b1 ppdCreatePPDFromIPP2 does not validate or sanitize the IPP attributes when writing them to a temporary PPD file, which permits injection of attacker-controlled data in the resulting PPD.
- CVE-2024-47177: cups-filters <= 2.0.1 foomatic-rip allows arbitrary command execution via the FoomaticRIPCommandLine PPD parameter.
These vulnerabilities could be exploited to create a malicious, fake printing device on a network-exposed Linux system running CUPS and trigger remote code execution when a print job is initiated.
"The issue arises due to improper handling of 'New Printer Available' announcements in the 'cups-browsed' component, combined with poor validation by 'cups' of the information provided by a malicious printing resource," explained network security company Ontinue.
The flaw allows an attacker to get the vulnerable system to install a malicious printer driver, which, once triggered by a print job, leads to the execution of malicious code. The code runs with the privileges of the "lp" user rather than the superuser "root."
RHEL confirmed that all versions of the operating system are impacted by these flaws but noted they are not vulnerable in their default configuration. The company classified the issues as "Important" in severity due to their potentially low real-world impact.
"By chaining these vulnerabilities together, an attacker could potentially achieve remote code execution, leading to theft of sensitive data or damage to critical systems," stated RHEL.
Cybersecurity firm Rapid7 highlighted that affected systems could be exploited from the public internet or across network segments, provided that UDP port 631 is open and the vulnerable service is listening.
Palo Alto Networks disclosed that none of its products or cloud services utilize CUPS-related software packages and are not affected by the vulnerabilities.
Patches for these flaws are being developed and are expected to be released soon. Until then, users are advised to disable and remove the cups-browsed service if unnecessary and restrict or block traffic to UDP port 631.
"It appears the highly anticipated unauthenticated Linux RCE vulnerabilities may affect only a subset of systems," said Benjamin Harris, CEO of WatchTowr. "While the technical impact is severe, it's unlikely that desktop machines running CUPS are exposed to the internet in the same numbers or manner as typical server editions of Linux."
Satnam Narang, senior staff research engineer at Tenable, noted that these vulnerabilities are not as severe as other past incidents like Log4Shell or Heartbleed.
"The reality is that there are countless undiscovered vulnerabilities in both open-source and closed-source software," Narang said. "Security research plays a vital role in identifying these issues, and we must demand better from software vendors."
"For organizations focusing on these recent vulnerabilities, it's essential to remember that the most concerning threats are the known vulnerabilities actively exploited by advanced persistent threat groups and ransomware affiliates," he added.
