There’s been talk of this unauthenticated RCE vulnerability coming with a CVSS 9.9 rating but none of the technical details were publicly known until it was made public just now at the top of the hour. Simone Margaritelli discovered this vulnerability and has shared a write-up around this potentially very impactful Linux vulnerability.

This vulnerability, fortunately, doesn’t affect the Linux kernel but rather CUPS… The print server commonly used on Linux systems and other platforms.

…

From Attacking UNIX Systems via CUPS, Part I:

“A remote unauthenticated attacker can silently replace existing printers’ (or install new ones) IPP urls with a malicious one, resulting in arbitrary command execution (on the computer) when a print job is started (from that computer).”

…

This remote code execution issue can be exploited across the public Internet via a UDP packet to port 631 without needing any authentication, assuming the CUPS port is open through your router/firewall. LAN attacks are also possible via spoofing zeroconf / mDNS / DNS-SD advertisements.

Besides CUPS being used on Linux distributions, it also affects some BSDs, Oracle Solaris, Google Chrome OS, and others.

As of writing there is no Linux fix available for this high profile security issue. In the meantime it’s recommended to disable and remove the “cups-browsed” service, updating CUPS, or at least blocking all traffic to UDP port 631.

  • lime!English
    20•2 months ago

    the reporter is a real asshat, judging by their twitter.

    first: twitter post about the vuln, "disclosure is happening in less than two weeks", "i got patronized because the devs can't accept that their code is crap"

    "id rather just drop it and force them to fix it asap"

    then, later:

    "disclosure is happening at 20:00 utc"

    • @[email protected]
      22•2 months ago

      Yep. Also claimed “it affects all GNU/Linux” while it only really does CUPS and so on.

      Just alone full disclosure is a shit thing to do. Do not even mention the part where it was intended as a responsible disclosure.

      • @[email protected]English
        13•2 months ago

        Ya I was worried this was going to affect something like OpenWRT and a lot of shit was about to get fucked over. CUPS? 99.9% of people are gonna have that port closed on their router. Sure this is important to fix but a 9.9? Nah

    • @[email protected]
      11•2 months ago

      Blue check on Twitter… Someone who’s paying $10/mo to the world’s richest person has an overinflated sense of importance… well… What’re you gonna do?