Entirely personal recommendation, take it or leave it: I’ve seen and attacked enough of this codebase to remove any CUPS service, binary and library from any of my systems and never again use a UNIX system to print. I’m also removing every zeroconf / avahi / bonjour listener. You might consider doing the same.
Great advice. It would appear these developers don’t take security seriously.
Mdns is something most people have no idea exists.
Oh, neat, all my devices broadcast all their open ports, services, addresses, hardware and names? Cool!
No.
If your router/firewall is configured to let these broadcasts through you have a problem. If it is working correctly and you have an attacker on your lan? You have already lost.
It depends. If you're using a laptop and say you take it to university or work then you're not on your LAN. You're on someone else's LAN and they may have no interest in trying to stop these types of attacks via any kind of client isolation or it may be incomplete.
I can imagine it's a very normal scenario for university students to have CUPS running and available on all networks as they may need to print at their university.
You've just described every enterprise who allows Linux in their environment.
Going to rely on security through obscurity instead?
Errr I use mdns all the time...
Someone doesn't like apple
Nobody likes Apple. They're just afraid to say they don't.
They're standardised zeroconnf protocols. Apple was part of the early development.
Bonjour is the apple implementation for mDNS.
Avahi is the GPL compliant implementation.
mDNS, llmnr (ms developed), have been known for ages to be vulnerable.
I could similarly link you an internet search for http or tls vulnerability, I fail to see your point
Worse than the exploit, is hearing the struggles the author faced to report it
Twenty-two days of arguments, condescension, several gaslighting attempts, more or less subtle personal attacks, dozens of emails and messages, more than 100 pages of text in total. Hours and hours and hours and hours and fucking hours. Not to mention somehow being judged by a big chunk of the infosec community with a tendency of talking and judging situations they simply don’t know.
I mean, OK, it's a vulnerability and there are interesting implications, but this is hardly significant in any pracitcal sense of the word.
the potential victim has to run their system without a firewall, has to print to the printer they've never interacted with before and then the attacker can run shit with whatever the printing system's user id is, which shouldn't be an issue on any reasonably modern distro.
I routinely remove cups and friends from any system I run because I have no need for printing and it bothers me to see it constantly during every system upgrade.
Wait, so how do we print now?
Lol what has more of an attack surface: CUPS or a reactos VM?
Udp sent to port 631. Isn't firewall on router going to block that anyway?
Firewall on everything gonna block that lol
Right so whats the issue here? If I have cups exposed to the internet I deserve to get ruined. LOL
An infected phone app on your wifi can screw you.
cups-browsed <= 2.0.1 binds on UDP INADDR_ANY:631 trusting any packet from any source
Well that would explain why I didn't have it installed (although I did have other parts of cups until jwz coincidentally reminded us two days ago that it can all be removed if you don't have a printer.) I clear out anything that opens ports I don't need to be open. A practice I would recommend to anyone.
I mean I guess that’s sound advice if you don’t need to, I don’t know, print?
Indeed. But cups-browsed isn't necessary in order to be able to print things, it's for automatically discovering new printers on the network.
I have cups (but not cups-browsed) installed, but I only start the service when I need to print something a few times a year.
Until then it is only a binary sitting in a folder, nothing more.
Honestly it isn't a big deal if you just use it on local host. Just make sure cups is sandboxes like it should be. (Systemd)
Yes, but exactly that was/is the issue of this bug. cups-browsed was attaching itself to every available IP on the system.
And cups-browsed can't only be bind to localhost, it would defeat the whole purpose of that tool. For it to be able to find other printers in the network it needs to be bound to a non-localhost-IP address.
So, not much to sandbox
Oh, hey! Wasn't even a problem for me.
I had updates today that were security related about this.
damn. that's a pretty shit one.
BRB.
sudo apt purge cups
Done. This should not even be part of baseline Ubuntu desktop. Speaking for myself but I have not had a printer for about 15 years. The paperless office really did become reality.
About 25 years for me.
For most people it's a better option to use a local print shop for the odd times that they need something printed.
More options for printing too.
I don't know if I would like to have my personal data that I needed to print out on any system in a print shop. Printers and Copy machines in print shops often have internal HDD where the files are stored for caching reasons, often for months or even years (depending of the size of the HDD and how much the device is used) until some internal cleanup process deletes them.
Great advice. It would appear these developers don’t take security seriously.
Mdns is something most people have no idea exists.
Oh, neat, all my devices broadcast all their open ports, services, addresses, hardware and names? Cool!
No.
If your router/firewall is configured to let these broadcasts through you have a problem. If it is working correctly and you have an attacker on your lan? You have already lost.
It depends. If you're using a laptop and say you take it to university or work then you're not on your LAN. You're on someone else's LAN and they may have no interest in trying to stop these types of attacks via any kind of client isolation or it may be incomplete.
I can imagine it's a very normal scenario for university students to have CUPS running and available on all networks as they may need to print at their university.
You've just described every enterprise who allows Linux in their environment.
Going to rely on security through obscurity instead?
Errr I use mdns all the time...
Someone doesn't like apple
Nobody likes Apple. They're just afraid to say they don't.
They're standardised zeroconnf protocols. Apple was part of the early development.
Bonjour is the apple implementation for mDNS.
Avahi is the GPL compliant implementation.
mDNS, llmnr (ms developed), have been known for ages to be vulnerable.
https://en.m.wikipedia.org/wiki/Zero-configuration_networking#Standardization
*I don't like apple
To be vulnerable to what?
https://duckduckgo.com/?q=mdns+vulnerability&t=fpas&ia=web
https://book.hacktricks.xyz/generic-methodologies-and-resources/pentesting-network/spoofing-llmnr-nbt-ns-mdns-dns-and-wpad-and-relay-attacks
I could similarly link you an internet search for http or tls vulnerability, I fail to see your point
Worse than the exploit, is hearing the struggles the author faced to report it
I mean, OK, it's a vulnerability and there are interesting implications, but this is hardly significant in any pracitcal sense of the word.
the potential victim has to run their system without a firewall, has to print to the printer they've never interacted with before and then the attacker can run shit with whatever the printing system's user id is, which shouldn't be an issue on any reasonably modern distro.
I routinely remove cups and friends from any system I run because I have no need for printing and it bothers me to see it constantly during every system upgrade.
Wait, so how do we print now?
Lol what has more of an attack surface: CUPS or a reactos VM?
RPI print server + sshfs?
Udp sent to port 631. Isn't firewall on router going to block that anyway?
Firewall on everything gonna block that lol
Right so whats the issue here? If I have cups exposed to the internet I deserve to get ruined. LOL
An infected phone app on your wifi can screw you.
Well that would explain why I didn't have it installed (although I did have other parts of cups until jwz coincidentally reminded us two days ago that it can all be removed if you don't have a printer.) I clear out anything that opens ports I don't need to be open. A practice I would recommend to anyone.
I mean I guess that’s sound advice if you don’t need to, I don’t know, print?
Indeed. But cups-browsed isn't necessary in order to be able to print things, it's for automatically discovering new printers on the network.
I have cups (but not cups-browsed) installed, but I only start the service when I need to print something a few times a year. Until then it is only a binary sitting in a folder, nothing more.
Honestly it isn't a big deal if you just use it on local host. Just make sure cups is sandboxes like it should be. (Systemd)
Yes, but exactly that was/is the issue of this bug. cups-browsed was attaching itself to every available IP on the system. And cups-browsed can't only be bind to localhost, it would defeat the whole purpose of that tool. For it to be able to find other printers in the network it needs to be bound to a non-localhost-IP address. So, not much to sandbox
Oh, hey! Wasn't even a problem for me.
I had updates today that were security related about this.
damn. that's a pretty shit one.
BRB.
sudo apt purge cupsDone. This should not even be part of baseline Ubuntu desktop. Speaking for myself but I have not had a printer for about 15 years. The paperless office really did become reality.
About 25 years for me.
For most people it's a better option to use a local print shop for the odd times that they need something printed.
More options for printing too.
I don't know if I would like to have my personal data that I needed to print out on any system in a print shop. Printers and Copy machines in print shops often have internal HDD where the files are stored for caching reasons, often for months or even years (depending of the size of the HDD and how much the device is used) until some internal cleanup process deletes them.