Unauthenticated RCE Flaw With CVSS 9.9 Rating For Linux Systems Affects CUPS

pnutzh4x0r@lemmy.ndlug.org to Linux@lemmy.ml – 117 points – Unauthenticated RCE Flaw With CVSS 9.9 Rating For Linux Systems Affects CUPS
phoronix.com

There's been talk of this unauthenticated RCE vulnerability coming with a CVSS 9.9 rating but none of the technical details were publicly known until it was made public just now at the top of the hour. Simone Margaritelli discovered this vulnerability and has shared a write-up around this potentially very impactful Linux vulnerability.

This vulnerability, fortunately, doesn't affect the Linux kernel but rather CUPS... The print server commonly used on Linux systems and other platforms.

...

From Attacking UNIX Systems via CUPS, Part I:

"A remote unauthenticated attacker can silently replace existing printers’ (or install new ones) IPP urls with a malicious one, resulting in arbitrary command execution (on the computer) when a print job is started (from that computer)."

...

This remote code execution issue can be exploited across the public Internet via a UDP packet to port 631 without needing any authentication, assuming the CUPS port is open through your router/firewall. LAN attacks are also possible via spoofing zeroconf / mDNS / DNS-SD advertisements.

Besides CUPS being used on Linux distributions, it also affects some BSDs, Oracle Solaris, Google Chrome OS, and others.

As of writing there is no Linux fix available for this high profile security issue. In the meantime it's recommended to disable and remove the "cups-browsed" service, updating CUPS, or at least blocking all traffic to UDP port 631.

28

I had a moment of actual laughter.

I was expecting a kernel issue handling networking connections or SSH or who the fuck knows but... cups?

Printers, they ruin everything.

Loads of complex code exposed to an assumed trusted network is the model of printers. They’re going to be full of security issues.

This stuff should be sandboxed and then never, ever exposed to the Internet.

I'm always befuddled how these things end up public on the internet. (I'm not really.)

Like, it's not like the printer is the one poking holes in your firewall while you sleep.*

*If it is, then you should feel great shame, throw away anything more complicated than a pair of dull scissors, and get a job digging holes then filling them back in.

the reporter is a real asshat, judging by their twitter.

first: twitter post about the vuln, "disclosure is happening in less than two weeks", "i got patronized because the devs can't accept that their code is crap"

"id rather just drop it and force them to fix it asap"

then, later:

"disclosure is happening at 20:00 utc"

Yep. Also claimed "it affects all GNU/Linux" while it only really does CUPS and so on.

Just alone full disclosure is a shit thing to do. Do not even mention the part where it was intended as a responsible disclosure.

Ya I was worried this was going to affect something like OpenWRT and a lot of shit was about to get fucked over. CUPS? 99.9% of people are gonna have that port closed on their router. Sure this is important to fix but a 9.9? Nah

Blue check on Twitter... Someone who's paying $10/mo to the world's richest person has an overinflated sense of importance... well... What're you gonna do?

Wtf???? "All GNU/Linux"???? This guy made me think Linus personally had to descend to Kernel-land and fix perhaps the most horrendous memory bug in existence. But no, surely CUPS IS ON EVERY MACHINE, RIGHT??????????

Fuck you to whoever blew this out of proportion.

1 more...

Remember when printers were connected by a USB cable?

Also, sudo ss -tunlp to see what ports are listening on your system and which applications/services use them. (Linux)

ss -K closes dead ports

If you didn't explicitly open a port, ask why it needs to be open (listening). (25, 22, 67, 53,5353)

Make sure what you did open is opened at the right addresses. Ie localhost, 0.0.0.0, 127.0.0.1, etc for the purpose.

Use a firewall and block ALL incoming traffic.

Wasn't it supposedly affecting ALL Gnu/Linux PLUS others?

That's so weird that my GNU/Linux isn't affected by this vulnerability...

Next time that margarine is going to scream "wolf", I will take it with a grain of salt...

Source: https://nitter.poast.org/evilsocket/status/1838169889330135132

While I'm glad that there are people who do this work and certainly appreciate it. I also read his tweets and this person did seem to come off as a bit annoying. Like I get it. Security is important. However, things not moving as fast as you like is no reason to act like that.

So if Cups is properly sandboxes this is less of an issue? Still not good but not show stopping

I don't think this is 9.9 worthly

Update:

You can use this to get a shell as the lp service user

Good news, it's not a 9.9. https://www.redhat.com/en/blog/red-hat-response-openprinting-cups-vulnerabilities

Yup, called it: non-mandatory piece of software. Plus you have to have been dumb enough to deliberately forward the port at your router for the general-case attack, and you have to print something (which I do maybe twice a month) for any command injection to take place.

This does need to be patched, since there is some risk if you have CUPS running and another device on your LAN has already been compromised, but it's definitely not the earthshattering kaboom the discoverer misrepresented it as.

No port forwarding needed when the ISP provides a proper IPv6 subnet. Normal IPv6 router advertisement will then provide a public reachable address for every IPv6 capable device.

But with the size of IPv6 it makes searching for that not really easy, so it only a small attack vector.

My router will still block all ports not explicitly allowed for the hosts regardless of protocol, it's a firewall after all and not just NAT. Just because the host addressable doesn't mean its ports are reachable.

Unfortunately many of the routers provided by ISPs I have seen where not configured that way by default. They only used NAT as firewall, so without configured port forwarding nothing could be reached with IPv4. But for IPv6: If you know the IPv6 for any system on the local network it is free available on all ports. It is the first thing I check when someone asks me to check their network or configure their internet, and only Fritz!Box have a sane default for IPv6 (but to be honest my other experiences are mostly with shitty Vodafone and german Telekom routers so it is a very limited set, and I really hope that most others are better.)

This is a big nothingburger because it doesn't have a cute name, a marketing campaign, or a silly logo. /s

Hmm, never had cups-browsed enabled as I do not need network printing with LDAP or legacy cups. Discovery using DNS-SD/mDNS and driverless printing work perfectly fine without it.

I am not sure if the driverless discovery ever can generate a PPD with arbitrary commands.