OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.8 and earlier, when starting the cupsd server with a Listen configuration item pointing to a symbolic link, the cupsd process can be caused to perform an arbitrary chmod of the provided argument, providing world-writable access to the target. Given that cupsd is often running as root, this can result in the change of permission of any user or system files to be world writable. Given the aforementioned Ubuntu AppArmor context, on such systems this vulnerability is limited to those files modifiable by the cupsd process. In that specific case it was found to be possible to turn the configuration of the Listen argument into full control over the cupsd.conf and cups-files.conf configuration files. By later setting the User and Group arguments in cups-files.conf, and printing with a printer configured by PPD with a `FoomaticRIPCommandLine` argument, arbitrary user and group (not root) command execution could be achieved, which can further be used on Ubuntu systems to achieve full root command execution. Commit ff1f8a623e090dee8a8aadf12a6a4b25efac143d contains a patch for the issue.

According to the versions of the cups package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In     versions 2.4.8 and earlier, when starting the cupsd server with a Listen configuration item pointing to a     symbolic link, the cupsd process can be caused to perform an arbitrary chmod of the provided argument,     providing world-writable access to the target. Given that cupsd is often running as root, this can result     in the change of permission of any user or system files to be world writable. Given the aforementioned     Ubuntu AppArmor context, on such systems this vulnerability is limited to those files modifiable by the     cupsd process. In that specific case it was found to be possible to turn the configuration of the Listen     argument into full control over the cupsd.conf and cups-files.conf configuration files. By later setting     the User and Group arguments in cups-files.conf, and printing with a printer configured by PPD with a     `FoomaticRIPCommandLine` argument, arbitrary user and group (not root) command execution could be     achieved, which can further be used on Ubuntu systems to achieve full root command execution. Commit     ff1f8a623e090dee8a8aadf12a6a4b25efac143d contains a patch for the issue.(CVE-2024-35235)

Tenable has extracted the preceding description block directly from the EulerOS cups security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the cups package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In     versions 2.4.8 and earlier, when starting the cupsd server with a Listen configuration item pointing to a     symbolic link, the cupsd process can be caused to perform an arbitrary chmod of the provided argument,     providing world-writable access to the target. Given that cupsd is often running as root, this can result     in the change of permission of any user or system files to be world writable. Given the aforementioned     Ubuntu AppArmor context, on such systems this vulnerability is limited to those files modifiable by the     cupsd process. In that specific case it was found to be possible to turn the configuration of the Listen     argument into full control over the cupsd.conf and cups-files.conf configuration files. By later setting     the User and Group arguments in cups-files.conf, and printing with a printer configured by PPD with a     `FoomaticRIPCommandLine` argument, arbitrary user and group (not root) command execution could be     achieved, which can further be used on Ubuntu systems to achieve full root command execution. Commit     ff1f8a623e090dee8a8aadf12a6a4b25efac143d contains a patch for the issue. (CVE-2024-35235)

Tenable has extracted the preceding description block directly from the EulerOS cups security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:5644 advisory.

    The Common UNIX Printing System (CUPS) provides a portable printing layer for Linux, UNIX, and similar     operating systems.

    Security Fix(es):

    * cups: Cupsd Listen arbitrary chmod 0140777 (CVE-2024-35235)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2024:4776 advisory.

    * cups: Cupsd Listen arbitrary chmod 0140777 (CVE-2024-35235)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:4715 advisory.

    The Common UNIX Printing System (CUPS) provides a portable printing layer for Linux, UNIX, and similar     operating systems.

    Security Fix(es):

    * cups: Cupsd Listen arbitrary chmod 0140777 (CVE-2024-35235)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the cups package has been released.

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2024-4776 advisory.

    [1:2.3.3op2-27]
    - Revert the cups-libs license identifier to the 'legacy' format

    [1:2.3.3op2-26]
    - RHEL-40388 cups: Cupsd Listen arbitrary chmod 0140777
    - Delete the domain socket file after stopping the cups.socket service
    - Fix cupsd Listener checks

    [1:2.3.3op2-25]
    - CVE-2024-35235 cups: Cupsd Listen arbitrary chmod 0140777

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:4776 advisory.

    The Common UNIX Printing System (CUPS) provides a portable printing layer for Linux, UNIX, and similar     operating systems.

    Security Fix(es):

    * cups: Cupsd Listen arbitrary chmod 0140777 (CVE-2024-35235)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-660 advisory.

    OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In     versions 2.4.8 and earlier, when starting the cupsd server with a Listen configuration item pointing to a     symbolic link, the cupsd process can be caused to perform an arbitrary chmod of the provided argument,     providing world-writable access to the target. Given that cupsd is often running as root, this can result     in the change of permission of any user or system files to be world writable. Given the aforementioned     Ubuntu AppArmor context, on such systems this vulnerability is limited to those files modifiable by the     cupsd process. In that specific case it was found to be possible to turn the configuration of the Listen     argument into full control over the cupsd.conf and cups-files.conf configuration files. By later setting     the User and Group arguments in cups-files.conf, and printing with a printer configured by PPD with a     `FoomaticRIPCommandLine` argument, arbitrary user and group (not root) command execution could be     achieved, which can further be used on Ubuntu systems to achieve full root command execution. Commit     ff1f8a623e090dee8a8aadf12a6a4b25efac143d contains a patch for the issue. (CVE-2024-35235)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:4580 advisory.

    The Common UNIX Printing System (CUPS) provides a portable printing layer for Linux, UNIX, and similar     operating systems.

    Security Fix(es):

    * cups: Cupsd Listen arbitrary chmod 0140777 (CVE-2024-35235)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-7c36291390 advisory.

    Rebase to 2.4.10, security fix for CVE-2024-35235

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2024:4265 advisory.

    * cups: Cupsd Listen arbitrary chmod 0140777 (CVE-2024-35235)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2024-4265 advisory.

    [ - 1:2.2.6-60]
    - RHEL-40386 cups: Cupsd Listen arbitrary chmod 0140777
    - Delete the domain socket file after stopping the cups.socket service
    - Fix cupsd Listener checks

    [1:2.2.6-59]
    - RHEL-40386 cups: Cupsd Listen arbitrary chmod 0140777
    - Require cups.socket in cupsd service file

    [1:2.2.6-58]
    - CVE-2024-35235 cups: Cupsd Listen arbitrary chmod 0140777

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:4265 advisory.

    The Common UNIX Printing System (CUPS) provides a portable printing layer for Linux, UNIX, and similar     operating systems.

    Security Fix(es):

    * cups: Cupsd Listen arbitrary chmod 0140777 (CVE-2024-35235)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-a3d1f80409 advisory.

    Rebase to 2.4.10, security fix for CVE-2024-35235

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 23.10 / 24.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-6844-1 advisory.

    Rory McNamara discovered that when starting the cupsd server with a Listen configuration item, the cupsd     process fails to validate if bind call passed. An attacker could possibly trick cupsd to perform an     arbitrary chmod of the provided argument, providing world-writable access to the target.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by a vulnerability as referenced in the dla-3826 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-3826-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                    Thorsten Alteholz     June 13, 2024                                 https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : cups     Version        : 2.2.10-6+deb10u10     CVE ID         : CVE-2024-35235


    An issue has been found in cups, the Common UNIX Printing System(tm).
    When starting the cupsd server with a Listen configuration item pointing     to a symbolic link, the cupsd process can be caused to perform an     arbitrary chmod of the provided argument, providing world-writable access     to the target.



    For Debian 10 buster, this problem has been fixed in version     2.2.10-6+deb10u10.

    We recommend that you upgrade your cups packages.

    For the detailed security status of cups please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/cups

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:2002-1 advisory.

    - CVE-2024-35235: Fixed a bug in cupsd that could allow an attacker to change the permissions of other     files in the system. (bsc#1225365)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:2003-1 advisory.

    - CVE-2024-35235: Fixed a bug in cupsd that could allow an attacker to change the permissions of other     files in the system. (bsc#1225365)
    - Handle local 'Negotiate' authentication response for cli clients (bsc#1223179)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of cups installed on the remote host is prior to 2.4.9. It is, therefore, affected by a vulnerability as referenced in the SSA:2024-163-02 advisory.

    New cups packages are available for Slackware 15.0 and -current to fix a security issue.

Tenable has extracted the preceding description block directly from the cups security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
208401	EulerOS 2.0 SP12 : cups (EulerOS-SA-2024-2499)	Nessus	Huawei Local Security Checks	medium
208346	EulerOS 2.0 SP12 : cups (EulerOS-SA-2024-2523)	Nessus	Huawei Local Security Checks	medium
208333	EulerOS 2.0 SP11 : cups (EulerOS-SA-2024-2574)	Nessus	Huawei Local Security Checks	medium
208316	EulerOS 2.0 SP11 : cups (EulerOS-SA-2024-2548)	Nessus	Huawei Local Security Checks	medium
207185	EulerOS 2.0 SP9 : cups (EulerOS-SA-2024-2384)	Nessus	Huawei Local Security Checks	medium
207159	EulerOS 2.0 SP9 : cups (EulerOS-SA-2024-2359)	Nessus	Huawei Local Security Checks	medium
207136	EulerOS 2.0 SP10 : cups (EulerOS-SA-2024-2432)	Nessus	Huawei Local Security Checks	medium
207112	EulerOS 2.0 SP10 : cups (EulerOS-SA-2024-2409)	Nessus	Huawei Local Security Checks	medium
205877	RHEL 9 : cups (RHSA-2024:5644)	Nessus	Red Hat Local Security Checks	medium
204725	AlmaLinux 9 : cups (ALSA-2024:4776)	Nessus	Alma Linux Local Security Checks	medium
204596	RHEL 8 : cups (RHSA-2024:4715)	Nessus	Red Hat Local Security Checks	medium
204194	Photon OS 4.0: Cups PHSA-2024-4.0-0629	Nessus	PhotonOS Local Security Checks	medium
204126	Oracle Linux 9 : cups (ELSA-2024-4776)	Nessus	Oracle Linux Local Security Checks	medium
203674	RHEL 9 : cups (RHSA-2024:4776)	Nessus	Red Hat Local Security Checks	medium
203601	Photon OS 5.0: Cups PHSA-2024-5.0-0289	Nessus	PhotonOS Local Security Checks	medium
202932	Amazon Linux 2023 : cups, cups-client, cups-devel (ALAS2023-2024-660)	Nessus	Amazon Linux Local Security Checks	medium
202497	RHEL 8 : cups (RHSA-2024:4580)	Nessus	Red Hat Local Security Checks	medium
202326	Fedora 39 : cups (2024-7c36291390)	Nessus	Fedora Local Security Checks	medium
201533	AlmaLinux 8 : cups (ALSA-2024:4265)	Nessus	Alma Linux Local Security Checks	medium
201336	Oracle Linux 8 : cups (ELSA-2024-4265)	Nessus	Oracle Linux Local Security Checks	medium
201292	RHEL 8 : cups (RHSA-2024:4265)	Nessus	Red Hat Local Security Checks	medium
201224	Fedora 40 : cups (2024-a3d1f80409)	Nessus	Fedora Local Security Checks	medium
200879	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 23.10 / 24.04 LTS : CUPS vulnerability (USN-6844-1)	Nessus	Ubuntu Local Security Checks	medium
200497	Debian dla-3826 : cups - security update	Nessus	Debian Local Security Checks	medium
200463	SUSE SLES12 Security Update : cups (SUSE-SU-2024:2002-1)	Nessus	SuSE Local Security Checks	medium
200460	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : cups (SUSE-SU-2024:2003-1)	Nessus	SuSE Local Security Checks	medium
200369	Slackware Linux 15.0 / current cups Vulnerability (SSA:2024-163-02)	Nessus	Slackware Local Security Checks	medium

Detections

Analytics

CVE-2024-35235

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium