CVE-2024-47175 — Improper Input Validation in Libppd

CWE-20 — Improper Input ValidationCWE-77 — Command InjectionCWE-940 — Improper Verification of Source of a Communication Channel19 documents10 sources
Severity
9.8CRITICALNVD
CNA8.6
EPSS
33.1%
top 3.10%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Apple CupsOpenprinting LibppdDebian Linux
Timeline
PublishedSep 26
Latest updateOct 29

Description

CUPS is a standards-based, open-source printing system, and `libppd` can be used for legacy PPD file support. The `libppd` function `ppdCreatePPDFromIPP2` does not sanitize IPP attributes when creating the PPD buffer. When used in combination with other functions such as `cfGetPrinterAttributes5`, can result in user controlled input and ultimately code execution via Foomatic. This vulnerability can be part of an exploit chain leading to remote code execution (RCE), as described in CVE-2024-47176…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages3 packages

▶CVEListV5openprinting/libppd2.1b1
▶NVDopenprinting/libppd2.0.0+1
▶Debianapple/cups< 2.3.3op2-3+deb11u9+3

Also affects: Debian Linux 11.0

Patches

Patch: github.com ↗

🔴Vulnerability Details

2
OSV
CVE-2024-47175: CUPS is a standards-based, open-source printing system, and `libppd` can be used for legacy PPD file support↗2024-09-26
▶
CVEList
libppd's ppdCreatePPDFromIPP2 function does not sanitize IPP attributes when creating the PPD buffer↗2024-09-26
▶

🔍Detection Rules

5
Elastic
Network Connection by Cups or Foomatic-rip Child↗
▶
Elastic
Suspicious Execution from Foomatic-rip or Cupsd Parent↗
▶
Elastic
Cupsd or Foomatic-rip Shell Execution↗
▶
Elastic
File Creation by Cups or Foomatic-rip Child↗
▶
Elastic
Printer User (lp) Shell Execution↗
▶

📋Vendor Advisories

7
Chrome
Stable Channel Update for ChromeOS / ChromeOS Flex: CVE-2024-47175↗2024-10-29
▶
Ubuntu
CUPS vulnerability↗2024-10-07
▶
Ubuntu
CUPS vulnerability↗2024-10-01
▶
Ubuntu
libppd vulnerability↗2024-09-26
▶
Red Hat
cups: libppd: remote command injection via attacker controlled data in PPD file↗2024-09-26
▶

🕵️Threat Intelligence

2
Wiz
OpenPrinting CUPS Vulnerabilities: Analysis of related CVEs | Wiz Blog↗2024-09-29
▶
Wiz
OpenPrinting CUPS Vulnerabilities: Analysis of related CVEs | Wiz Blog↗2024-09-29
▶
CVE-2024-47175 — Improper Input Validation in Libppd | cvebase