CVE-2024-47175
published 2024-09-26CVE-2024-47175: CUPS is a standards-based, open-source printing system, and `libppd` can be used for legacy PPD file support. The `libppd` function `ppdCreatePPDFromIPP2` does…
PriorityP180critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EXPLOIT
EPSS
62.47%
99.1th percentile
CUPS is a standards-based, open-source printing system, and `libppd` can be used for legacy PPD file support. The `libppd` function `ppdCreatePPDFromIPP2` does not sanitize IPP attributes when creating the PPD buffer. When used in combination with other functions such as `cfGetPrinterAttributes5`, can result in user controlled input and ultimately code execution via Foomatic. This vulnerability can be part of an exploit chain leading to remote code execution (RCE), as described in CVE-2024-47176.
Affected
29 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | cups | >= 0 < 2.3.3op2-3+deb11u9 | 2.3.3op2-3+deb11u9 |
| apple | cups | >= 0 < 2.4.2-3+deb12u8 | 2.4.2-3+deb12u8 |
| apple | cups | >= 0 < 2.4.10-2 | 2.4.10-2 |
| apple | cups | >= 0 < 2.4.10-2 | 2.4.10-2 |
| debian | cups | < cups 2.4.2-3+deb12u8 (bookworm) | cups 2.4.2-3+deb12u8 (bookworm) |
| debian | cups-filters | < cups-filters 1.28.17-3+deb12u1 (bookworm) | cups-filters 1.28.17-3+deb12u1 (bookworm) |
| debian | debian_linux | — | — |
| debian | libppd | < cups 2.4.2-3+deb12u8 (bookworm) | cups 2.4.2-3+deb12u8 (bookworm) |
| chrome_chrome | — | — | |
| linuxfoundation | cups-filters | >= 0 < 1.28.7-1+deb11u3 | 1.28.7-1+deb11u3 |
| linuxfoundation | cups-filters | >= 0 < 1.28.17-3+deb12u1 | 1.28.17-3+deb12u1 |
| linuxfoundation | cups-filters | >= 0 < 1.28.17-5 | 1.28.17-5 |
| linuxfoundation | cups-filters | >= 0 < 1.28.17-5 | 1.28.17-5 |
| openprinting | cups | < 2.4.13 | 2.4.13 |
| openprinting | cups-browsed | — | — |
| openprinting | libppd | <= 2.0.0 | — |
| openprinting | libppd | — | — |
| paloalto | cloud_ngfw | — | — |
| paloalto | cortex_xdr | — | — |
| paloalto | cortex_xdr_agent | — | — |
| paloalto | cortex_xsiam | — | — |
| paloalto | cortex_xsoar | — | — |
| paloalto | globalprotect_app | — | — |
| paloalto | pan-os | — | — |
| paloalto | prisma_access | — | — |
Detection & IOCsextracted from sources · hover to see the quote
sigma↗
process where host.os.type == "linux" and event.type == "start" and
event.action == "exec" and process.parent.name == "foomatic-rip" and
process.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish")
and not process.command_line like ("*/tmp/foomatic-*", "*-sDEVICE=ps2write*")sigma↗
process where host.os.type == "linux" and event.type == "start" and
event.action == "exec" and user.name == "lp" and
process.parent.name in ("cupsd", "foomatic-rip", "bash", "dash", "sh",
"tcsh", "csh", "zsh", "ksh", "fish") and process.name in ("bash", "dash",
"sh", "tcsh", "csh", "zsh", "ksh", "fish") and not process.command_line
like ("*/tmp/foomatic-*", "*-sDEVICE=ps2write*")- →Detect shell processes spawned directly by foomatic-rip on Linux; legitimate print jobs do not require shell execution, making this a strong indicator of CVE-2024-47175/CVE-2024-47177 exploitation. ↗
- →Monitor for any process execution under the 'lp' user that spawns a shell (bash, dash, sh, tcsh, csh, zsh, ksh, fish); the lp user should not normally spawn interactive shells. ↗
- →Alert on network connections initiated by child processes of foomatic-rip; legitimate print operations do not involve these processes establishing outbound connections. ↗
- →Monitor for files written to /tmp/ by the 'lp' user, which is a common indicator of PoC/exploit activity for these CUPS vulnerabilities. ↗
- →Hunt for the FoomaticRIPCommandLine directive appearing in PPD files written to temporary locations; its presence indicates attacker-injected command execution payloads via CVE-2024-47175. ↗
- →On local networks, watch for spoofed mDNS/DNS-SD/ZeroConf printer advertisements registering new IPP printer services, which is the LAN-side attack vector for these vulnerabilities. ↗
- ·CVE-2024-47175 affects libppd ≤ 2.1b1 only; systems running patched or newer versions of libppd are not vulnerable. ↗
- ·Exploitation of CVE-2024-47175 in the full RCE chain requires user interaction: a print job must be initiated to the malicious printer for the injected FoomaticRIPCommandLine directive to execute. ↗
- ·The lp user executing arbitrary commands may be constrained by AppArmor or SELinux policies; default configurations on many systems allow effective payloads such as reverse shells, but hardened environments may limit impact. ↗
- ·Interactive reverse shells are not immediately supported via this exploit because the lp user does not have a login shell by default, though this can be worked around. ↗
- ·Cloud environments are assessed as highly unlikely to be exploited remotely via the currently known method, since UDP port 631 is rarely open and printing is rarely used in cloud workloads. ↗
- ·Setting BrowseRemoteProtocols to 'dnssd' (removing 'cups') in /etc/cups/cups-browsed.conf mitigates the attack vector without fully disabling CUPS, for environments that require printing. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
osv9.8CRITICAL
vendor_debian8.6HIGH
vendor_redhat8.6HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Chrome
Stable Channel Update for ChromeOS / ChromeOS Flex: CVE-2024-47175
vendor_chrome·2024-10-29·CVSS 8.6
CVE-2024-47175 [HIGH] Stable Channel Update for ChromeOS / ChromeOS Flex: CVE-2024-47175
Stable Channel Update for ChromeOS / ChromeOS Flex
CVE-2024-47175
Ubuntu
CUPS vulnerability
vendor_ubuntu·2024-10-07
CVE-2024-47175 CUPS vulnerability
Title: CUPS vulnerability
Summary: CUPS could be made to crash or run programs if it received specially
crafted network traffic.
USN-7041-1 fixed a vulnerability in CUPS. This update provides
the corresponding update for Ubuntu 16.04 LTS.
Original advisory details:
Simone Margaritelli discovered that CUPS incorrectly sanitized IPP
data when creating PPD files. A remote attacker could possibly use this
issue to manipulate PPD files and execute arbitrary code when a printer is
used.
Instructions: In general, a standard system update will make all the necessary changes.
Ubuntu
CUPS vulnerability
vendor_ubuntu·2024-10-01
CVE-2024-47175 CUPS vulnerability
Title: CUPS vulnerability
Summary: CUPS could be made to crash or run programs if it received specially
crafted network traffic.
USN-7041-1 fixed a vulnerability in CUPS. This update provides
the corresponding update for Ubuntu 18.04 LTS.
Original advisory details:
Simone Margaritelli discovered that CUPS incorrectly sanitized IPP
data when creating PPD files. A remote attacker could possibly use this
issue to manipulate PPD files and execute arbitrary code when a printer is
used.
Instructions: In general, a standard system update will make all the necessary changes.
Palo Alto
Informational: No Impact of CUPS Vulnerabilities on Palo Alto Networks Products
vendor_paloalto·2024-09-26·CVSS 8.6
CVE-2024-47076 [HIGH] CWE-78 Informational: No Impact of CUPS Vulnerabilities on Palo Alto Networks Products
Informational: No Impact of CUPS Vulnerabilities on Palo Alto Networks Products
The Palo Alto Networks Product Security Assurance team has evaluated CVE-2024-47076, CVE-2024-47177, CVE-2024-47175, and CVE-2024-47176 in the Common UNIX Printing System (CUPS) as they relate to our products.
Based on current information, Palo Alto Networks products and cloud services do not contain affected CUPS-related software packages and are not impacted by these issues.
Affected products: Cloud NGFW, Cortex XDR, Cortex XDR Agent, Cortex XSIAM, Cortex XSOAR, GlobalProtect App, PAN-OS, Prisma Access, Prisma Browser, Prisma Cloud, Prisma Cloud Compute, Prisma SD-WAN
Solution: No software updates are required at this time.
Workaround: Customers who decide to block CUPS traffic can create a Security poli
Ubuntu
libppd vulnerability
vendor_ubuntu·2024-09-26
CVE-2024-47175 libppd vulnerability
Title: libppd vulnerability
Summary: libppd could be made to run programs if it received specially crafted
network traffic.
Simone Margaritelli discovered that libppd incorrectly sanitized IPP data
when creating PPD files. A remote attacker could possibly use this issue to
manipulate PPD files and execute arbitrary code when a printer is used.
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
cups-browsed: cups-browsed binds on UDP INADDR_ANY:631 trusting any packet from any source
vendor_redhat·2024-09-26·CVSS 8.6
CVE-2024-47176 [HIGH] CWE-940 cups-browsed: cups-browsed binds on UDP INADDR_ANY:631 trusting any packet from any source
cups-browsed: cups-browsed binds on UDP INADDR_ANY:631 trusting any packet from any source
CUPS is a standards-based, open-source printing system, and `cups-browsed` contains network printing functionality including, but not limited to, auto-discovering print services and shared printers. `cups-browsed` binds to `INADDR_ANY:631`, causing it to trust any packet from any source, and can cause the `Get-Printer-Attributes` IPP request to an attacker controlled URL. When combined with other vulnerabilities, such as CVE-2024-47076, CVE-2024-47175, and CVE-2024-47177, an attacker can execute arbitrary commands remotely on the target machine without authentication when a malicious printer is printed to.
A security issue has been identified in OpenPrinting CUPS.
The function ppdCreatePPDFromIPP2
Red Hat
cups: libppd: remote command injection via attacker controlled data in PPD file
vendor_redhat·2024-09-26·CVSS 8.6
CVE-2024-47175 [HIGH] CWE-77 cups: libppd: remote command injection via attacker controlled data in PPD file
cups: libppd: remote command injection via attacker controlled data in PPD file
CUPS is a standards-based, open-source printing system, and `libppd` can be used for legacy PPD file support. The `libppd` function `ppdCreatePPDFromIPP2` does not sanitize IPP attributes when creating the PPD buffer. When used in combination with other functions such as `cfGetPrinterAttributes5`, can result in user controlled input and ultimately code execution via Foomatic. This vulnerability can be part of an exploit chain leading to remote code execution (RCE), as described in CVE-2024-47176.
A security vulnerability was found in OpenPrinting CUPS.
The function ppdCreatePPDFromIPP2 in the libppd library is responsible for generating a PostScript Printer Description (PPD) file based on attributes retrieved
Ubuntu
CUPS vulnerability
vendor_ubuntu·2024-09-26
CVE-2024-47175 CUPS vulnerability
Title: CUPS vulnerability
Summary: CUPS could be made to crash or run programs if it received specially
crafted network traffic.
Simone Margaritelli discovered that CUPS incorrectly sanitized IPP
data when creating PPD files. A remote attacker could possibly use this
issue to manipulate PPD files and execute arbitrary code when a printer is
used.
Instructions: In general, a standard system update will make all the necessary changes.
Debian
CVE-2024-47175: cups - CUPS is a standards-based, open-source printing system, and `libppd` can be used...
vendor_debian·2024·CVSS 8.6
CVE-2024-47175 [HIGH] CVE-2024-47175: cups - CUPS is a standards-based, open-source printing system, and `libppd` can be used...
CUPS is a standards-based, open-source printing system, and `libppd` can be used for legacy PPD file support. The `libppd` function `ppdCreatePPDFromIPP2` does not sanitize IPP attributes when creating the PPD buffer. When used in combination with other functions such as `cfGetPrinterAttributes5`, can result in user controlled input and ultimately code execution via Foomatic. This vulnerability can be part of an exploit chain leading to remote code execution (RCE), as described in CVE-2024-47176.
Scope: local
bookworm: resolved (fixed in 2.4.2-3+deb12u8)
bullseye: resolved (fixed in 2.3.3op2-3+deb11u9)
forky: resolved (fixed in 2.4.10-2)
sid: resolved (fixed in 2.4.10-2)
trixie: resolved (fixed in 2.4.10-2)
Debian
CVE-2024-47176: cups-filters - CUPS is a standards-based, open-source printing system, and `cups-browsed` conta...
vendor_debian·2024·CVSS 8.6
CVE-2024-47176 [HIGH] CVE-2024-47176: cups-filters - CUPS is a standards-based, open-source printing system, and `cups-browsed` conta...
CUPS is a standards-based, open-source printing system, and `cups-browsed` contains network printing functionality including, but not limited to, auto-discovering print services and shared printers. `cups-browsed` binds to `INADDR_ANY:631`, causing it to trust any packet from any source, and can cause the `Get-Printer-Attributes` IPP request to an attacker controlled URL. When combined with other vulnerabilities, such as CVE-2024-47076, CVE-2024-47175, and CVE-2024-47177, an attacker can execute arbitrary commands remotely on the target machine without authentication when a malicious printer is printed to.
Scope: local
bookworm: resolved (fixed in 1.28.17-3+deb12u1)
bullseye: resolved (fixed in 1.28.7-1+deb11u3)
forky: resolved (fixed in 1.28.17-5)
sid: resolved (fixed in 1.28.17-5)
trixie
OSV
CVE-2024-47176: CUPS is a standards-based, open-source printing system, and `cups-browsed` contains network printing functionality including, but not limited to, auto
osv·2024-09-26·CVSS 8.6
CVE-2024-47176 [HIGH] CVE-2024-47176: CUPS is a standards-based, open-source printing system, and `cups-browsed` contains network printing functionality including, but not limited to, auto
CUPS is a standards-based, open-source printing system, and `cups-browsed` contains network printing functionality including, but not limited to, auto-discovering print services and shared printers. `cups-browsed` binds to `INADDR_ANY:631`, causing it to trust any packet from any source, and can cause the `Get-Printer-Attributes` IPP request to an attacker controlled URL. When combined with other vulnerabilities, such as CVE-2024-47076, CVE-2024-47175, and CVE-2024-47177, an attacker can execute arbitrary commands remotely on the target machine without authentication when a malicious printer is printed to.
OSV
CVE-2024-47175: CUPS is a standards-based, open-source printing system, and `libppd` can be used for legacy PPD file support
osv·2024-09-26·CVSS 9.8
CVE-2024-47175 [CRITICAL] CVE-2024-47175: CUPS is a standards-based, open-source printing system, and `libppd` can be used for legacy PPD file support
CUPS is a standards-based, open-source printing system, and `libppd` can be used for legacy PPD file support. The `libppd` function `ppdCreatePPDFromIPP2` does not sanitize IPP attributes when creating the PPD buffer. When used in combination with other functions such as `cfGetPrinterAttributes5`, can result in user controlled input and ultimately code execution via Foomatic. This vulnerability can be part of an exploit chain leading to remote code execution (RCE), as described in CVE-2024-47176.
Elastic
Network Connection by Cups or Foomatic-rip Child
elastic_rules·CVSS 8.6
CVE-2024-47176 [HIGH] Network Connection by Cups or Foomatic-rip Child
Network Connection by Cups or Foomatic-rip Child
This detection rule addresses multiple vulnerabilities in the CUPS printing system, including CVE-2024-47176,
CVE-2024-47076, CVE-2024-47175, and CVE-2024-47177. Specifically, this rule detects network connections initiated by a
child processes of foomatic-rip. These flaws impact components like cups-browsed, libcupsfilters, libppd, and
foomatic-rip, allowing remote unauthenticated attackers to manipulate IPP URLs or inject malicious data through crafted
UDP packets or network spoofing. This can result in arbitrary command execution when a print job is initiated.
Query:
sequence by host.id with maxspan=10s
[process where host.os.type == "linux" and event.type == "start" and event.action == "exec" and
process.parent.name == "foomatic-rip"
Elastic
Suspicious Execution from Foomatic-rip or Cupsd Parent
elastic_rules·CVSS 8.6
CVE-2024-47176 [HIGH] Suspicious Execution from Foomatic-rip or Cupsd Parent
Suspicious Execution from Foomatic-rip or Cupsd Parent
This detection rule addresses multiple vulnerabilities in the CUPS printing system, including CVE-2024-47176,
CVE-2024-47076, CVE-2024-47175, and CVE-2024-47177. Specifically, this rule detects suspicious process command lines
executed by child processes of foomatic-rip and cupsd. These flaws impact components like cups-browsed, libcupsfilters,
libppd, and foomatic-rip, allowing remote unauthenticated attackers to manipulate IPP URLs or inject malicious data
through crafted UDP packets or network spoofing. This can result in arbitrary command execution when a print job is
initiated.
Query:
process where host.os.type == "linux" and event.type == "start" and event.action in ("exec", "exec_event", "start", "ProcessRollup2") and
process
Elastic
Cupsd or Foomatic-rip Shell Execution
elastic_rules·CVSS 8.6
CVE-2024-47176 [HIGH] Cupsd or Foomatic-rip Shell Execution
Cupsd or Foomatic-rip Shell Execution
This detection rule addresses multiple vulnerabilities in the CUPS printing system, including CVE-2024-47176,
CVE-2024-47076, CVE-2024-47175, and CVE-2024-47177. Specifically, this rule detects shell executions from the
foomatic-rip parent process. These flaws impact components like cups-browsed, libcupsfilters, libppd, and foomatic-rip,
allowing remote unauthenticated attackers to manipulate IPP URLs or inject malicious data through crafted UDP packets or
network spoofing. This can result in arbitrary command execution when a print job is initiated.
Query:
process where host.os.type == "linux" and event.type == "start" and
event.action in ("exec", "exec_event", "start", "ProcessRollup2") and process.parent.name == "foomatic-rip" and
process.name in
Elastic
File Creation by Cups or Foomatic-rip Child
elastic_rules·CVSS 8.6
CVE-2024-47176 [HIGH] File Creation by Cups or Foomatic-rip Child
File Creation by Cups or Foomatic-rip Child
This detection rule addresses multiple vulnerabilities in the CUPS printing system, including CVE-2024-47176,
CVE-2024-47076, CVE-2024-47175, and CVE-2024-47177. Specifically, this rule detects suspicious file creation events
executed by child processes of foomatic-rip. These flaws impact components like cups-browsed, libcupsfilters, libppd,
and foomatic-rip, allowing remote unauthenticated attackers to manipulate IPP URLs or inject malicious data through
crafted UDP packets or network spoofing. This can result in arbitrary command execution when a print job is initiated.
Query:
sequence by host.id with maxspan=10s
[process where host.os.type == "linux" and event.type == "start" and event.action in ("exec", "start") and
process.parent.name ==
Elastic
Printer User (lp) Shell Execution
elastic_rules·CVSS 8.6
CVE-2024-47176 [HIGH] Printer User (lp) Shell Execution
Printer User (lp) Shell Execution
This detection rule addresses multiple vulnerabilities in the CUPS printing system, including CVE-2024-47176,
CVE-2024-47076, CVE-2024-47175, and CVE-2024-47177. Specifically, this rule detects shell executions from the foomatic-rip
parent process through the default printer user (lp). These flaws impact components like cups-browsed, libcupsfilters,
libppd, and foomatic-rip, allowing remote unauthenticated attackers to manipulate IPP URLs or inject malicious data
through crafted UDP packets or network spoofing. This can result in arbitrary command execution when a print job is
initiated.
Query:
process where host.os.type == "linux" and event.type == "start" and
event.action in ("exec", "exec_event", "ProcessRollup2", "ProcessRollup2") and user.name == "
Wiz
Crying Out Cloud - October 2024 Newsletter | Wiz
blogs_wiz·2024-10-01·CVSS 9.0
CVE-2024-0132 [CRITICAL] Crying Out Cloud - October 2024 Newsletter | Wiz
Welcome back! In this edition, we bring you the latest in cloud security – noteworthy incidents, exclusive data, and crucial vulnerabilities. Let's dive in.
Here are our top picks!
## 🔍 Highlights
Critical Vulnerability in NVIDIA Container Toolkit
Wiz Research uncovered a critical vulnerability, CVE-2024-0132, in the widely used NVIDIA Container Toolkit. The vulnerability allows attackers with control over a container image to escape the container and gain full access to the underlying host. It is strongly recommended to update the affected package to the latest version 1.16.2, while focusing on container hosts that might run untrusted container images.
According to Wiz data, 33% of cloud environments are impacted by CVE-2024-0132.
Learn more in our blog .
## 🐞 High Profile Vulnerab
Wiz
OpenPrinting CUPS Vulnerabilities: Analysis of related CVEs | Wiz Blog
blogs_wiz·2024-09-29·CVSS 8.6
CVE-2024-47176 [HIGH] OpenPrinting CUPS Vulnerabilities: Analysis of related CVEs | Wiz Blog
The security researcher Simone Margaritelli ( evilsocket ), disclosed details of several vulnerabilities impacting CUPS and IPP packages: CVE-2024-47176, CVE-2024-47076, CVE-2024-47175, and CVE-2024-47177. These vulnerabilities are unlikely to be exploited in most cloud environments due to their requirements for exposing UDP port 631 and needing the victim to attempt a print request as part of the currently disclosed exploitation method.
The vulnerabilities received CVSS base scores ranging from 8.0 to 9.0. It is recommended to mitigate these vulnerabilities and apply patches.
## What are these vulnerabilities?
A remote, unauthenticated attacker can replace existing printers with a malicious one or add a new printer under their control, leading to arbitrary command execution when a prin
Wiz
OpenPrinting CUPS Vulnerabilities: Analysis of related CVEs | Wiz Blog
blogs_wiz·2024-09-29·CVSS 8.6
CVE-2024-47076 [HIGH] OpenPrinting CUPS Vulnerabilities: Analysis of related CVEs | Wiz Blog
The security researcher Simone Margaritelli (evilsocket), disclosed details of several vulnerabilities impacting CUPS and IPP packages: CVE-2024-47176, CVE-2024-47076, CVE-2024-47175, and CVE-2024-47177. These vulnerabilities are unlikely to be exploited in most cloud environments due to their requirements for exposing UDP port 631 and needing the victim to attempt a print request as part of the currently disclosed exploitation method.
The vulnerabilities received CVSS base scores ranging from 8.0 to 9.0. It is recommended to mitigate these vulnerabilities and apply patches.
# What are these vulnerabilities?
A remote, unauthenticated attacker can replace existing printers with a malicious one or add a new printer under their control, leading to arbitrary command execution when a print j
Elastic
Cups Overflow: When your printer spills more than Ink — Elastic Security Labs
blogs_elastic·2024-09-28·CVSS 6.8
[MEDIUM] Cups Overflow: When your printer spills more than Ink — Elastic Security Labs
28 September 2024•Mika Ayenson, PhD•Terrance DeJesus•Eric Forte•Ruben Groenewoud
# Cups Overflow: When your printer spills more than Ink
Elastic Security Labs discusses detection and mitigation strategies for vulnerabilities in the CUPS printing system, which allow unauthenticated attackers to exploit the system via IPP and mDNS, resulting in remote code execution (RCE) on UNIX-based systems such as Linux, macOS, BSDs, ChromeOS, and Solaris.
9 min readDetection Engineering, Product Updates
## Update October 2, 2024
The following packages introduced out-of-the-box (OOTB) rules to detect the exploitation of these vulnerabilities. Please check your "Prebuilt Security Detection Rules" integration versions or visit the Downloadable rule updates site.
- Stack Version 8.15 - Package Version
Elastic
Cups Overflow: When your printer spills more than Ink — Elastic Security Labs
blogs_elastic·2024-09-28
Cups Overflow: When your printer spills more than Ink — Elastic Security Labs
## Cups Overflow: When your printer spills more than Ink
Elastic Security Labs discusses detection and mitigation strategies for vulnerabilities in the CUPS printing system, which allow unauthenticated attackers to exploit the system via IPP and mDNS, resulting in remote code execution (RCE) on UNIX-based systems such as Linux, macOS, BSDs, ChromeOS, and Solaris.
## Update October 2, 2024
The following packages introduced out-of-the-box (OOTB) rules to detect the exploitation of these vulnerabilities. Please check your "Prebuilt Security Detection Rules" integration versions or visit the Downloadable rule updates site.
Stack Version 8.15 - Package Version 8.15.6+
Stack Version 8.14 - Package Version 8.14.12+
Stack Version 8.13 - Package Version 8.13.18+
Stack Version 8.12 - Package
Qualys
Unauthenticated RCE in CUPS: Critical Printing System Flaws
blogs_qualys·2024-09-26·CVSS 8.6
[HIGH] Unauthenticated RCE in CUPS: Critical Printing System Flaws
## Table of Contents
What Is CUPS?
CUPS Printing System Vulnerabilities
How to Fix CUPS Vulnerabilities:
Why These CUPS Printing Flaws Are a Serious Threat
Recommended Security Measures for Enterprises to mitigate RCE vulnerability
How Qualys Helps Detect and Fix CUPS Vulnerabilities
Conclusion
Next Steps to Secure Your CUPS Printing System
FAQ:
A critical set of unauthenticated Remote Code Execution (RCE) vulnerabilities in CUPS, affecting all GNU/Linux systems and potentially others, was disclosed today. These vulnerabilities allow a remote attacker to execute arbitrary code on a target system without valid credentials or prior access. Major organizations like Canonical and Red Hat have confirmed this flaw, assigning it a high severity with a CVSS score of 9.9 out of 10.
Based
Tenable
CVE-2024-47076, CVE-2024-47175, CVE-2024-47176, CVE-2024-47177: Frequently Asked Questions About Common UNIX Printing System (CUPS) Vulnerabilities
blogs_tenable·2024-09-26·CVSS 8.6
[HIGH] CVE-2024-47076, CVE-2024-47175, CVE-2024-47176, CVE-2024-47177: Frequently Asked Questions About Common UNIX Printing System (CUPS) Vulnerabilities
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Qualys
CUPS RCE Vulnerabilities: Patch Critical Flaws | Qualys
blogs_qualys·2024-09-26·CVSS 8.6
[HIGH] CUPS RCE Vulnerabilities: Patch Critical Flaws | Qualys
#### Table of Contents
- What Is CUPS?
- CUPS Printing System Vulnerabilities
- How to Fix CUPS Vulnerabilities:
- Why These CUPS Printing Flaws Are a Serious Threat
- Recommended Security Measures for Enterprises to mitigate RCE vulnerability
- How Qualys Helps Detect and Fix CUPS Vulnerabilities
- Conclusion
- Next Steps to Secure Your CUPS Printing System
- FAQ:
A critical set of unauthenticated Remote Code Execution (RCE) vulnerabilities in CUPS, affecting all GNU/Linux systems and potentially others, was disclosed today. These vulnerabilities allow a remote attacker to execute arbitrary code on a target system without valid credentials or prior access. Major organizations like Canonical and Red Hat have confirmed this flaw, assigning it a high severity with a CVSS score of 9.9 out o
Bugzilla
CVE-2024-47175 cups: libppd: remote command injection via attacker controlled data in PPD file
bugzilla·2024-09-23·CVSS 9.8
CVE-2024-47175 [CRITICAL] CVE-2024-47175 cups: libppd: remote command injection via attacker controlled data in PPD file
CVE-2024-47175 cups: libppd: remote command injection via attacker controlled data in PPD file
A remote attacker who has successfully installed or hijacked an exposed printer (via UPD or mDNS) and was able to return a malicious IPP attribute, the attacker may be able to exploit FoomaticRIPCommandLine to execute arbitrary commands. Due to a lack of sanitization in `cfGetPrinterAttributes` API and `ppdCreatePPDFromIPP2`, a vulnerable CUPS system will execute the `foomatic-rip` filter binary when a print job is sent to the printer.
Discussion:
This issue has been addressed in the following products:
Red Hat Enterprise Linux 9
Via RHSA-2024:7346 https://access.redhat.com/errata/RHSA-2024:7346
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 8.2 Adva
https://github.com/OpenPrinting/cups-browsed/security/advisories/GHSA-rj88-6mr5-rcw8https://github.com/OpenPrinting/cups-filters/security/advisories/GHSA-p9rh-jxmq-gq47https://github.com/OpenPrinting/libcupsfilters/security/advisories/GHSA-w63j-6g73-wmg5https://github.com/OpenPrinting/libppd/security/advisories/GHSA-7xfx-47qg-grp6https://www.cups.orghttps://www.evilsocket.net/2024/09/26/Attacking-UNIX-systems-via-CUPS-Part-Ihttp://www.openwall.com/lists/oss-security/2024/09/27/3https://github.com/OpenPrinting/libppd/commit/d681747ebf12602cb426725eb8ce2753211e2477https://lists.debian.org/debian-lts-announce/2024/09/msg00047.htmlhttps://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0016https://security.netapp.com/advisory/ntap-20241011-0001/
2024-09-26
Published