OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.8 and earlier, when starting the cupsd server with a Listen configuration item pointing to a symbolic link, the cupsd process can be caused to perform an arbitrary chmod of the provided argument, providing world-writable access to the target. Given that cupsd is often running as root, this can result in the change of permission of any user or system files to be world writable. Given the aforementioned Ubuntu AppArmor context, on such systems this vulnerability is limited to those files modifiable by the cupsd process. In that specific case it was found to be possible to turn the configuration of the Listen argument into full control over the cupsd.conf and cups-files.conf configuration files. By later setting the User and Group arguments in cups-files.conf, and printing with a printer configured by PPD with a `FoomaticRIPCommandLine` argument, arbitrary user and group (not root) command execution could be achieved, which can further be used on Ubuntu systems to achieve full root command execution. Commit ff1f8a623e090dee8a8aadf12a6a4b25efac143d contains a patch for the issue.

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2024:4265 advisory.

    * cups: Cupsd Listen arbitrary chmod 0140777 (CVE-2024-35235)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2024-4265 advisory.

    [ - 1:2.2.6-60]
    - RHEL-40386 cups: Cupsd Listen arbitrary chmod 0140777
    - Delete the domain socket file after stopping the cups.socket service
    - Fix cupsd Listener checks

    [1:2.2.6-59]
    - RHEL-40386 cups: Cupsd Listen arbitrary chmod 0140777
    - Require cups.socket in cupsd service file

    [1:2.2.6-58]
    - CVE-2024-35235 cups: Cupsd Listen arbitrary chmod 0140777

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:4265 advisory.

    The Common UNIX Printing System (CUPS) provides a portable printing layer for Linux, UNIX, and similar     operating systems.

    Security Fix(es):

    * cups: Cupsd Listen arbitrary chmod 0140777 (CVE-2024-35235)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-a3d1f80409 advisory.

    Rebase to 2.4.10, security fix for CVE-2024-35235

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 23.10 / 24.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-6844-1 advisory.

    Rory McNamara discovered that when starting the cupsd server with a Listen configuration item, the cupsd     process fails to validate if bind call passed. An attacker could possibly trick cupsd to perform an     arbitrary chmod of the provided argument, providing world-writable access to the target.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by a vulnerability as referenced in the dla-3826 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-3826-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                    Thorsten Alteholz     June 13, 2024                                 https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : cups     Version        : 2.2.10-6+deb10u10     CVE ID         : CVE-2024-35235


    An issue has been found in cups, the Common UNIX Printing System(tm).
    When starting the cupsd server with a Listen configuration item pointing     to a symbolic link, the cupsd process can be caused to perform an     arbitrary chmod of the provided argument, providing world-writable access     to the target.



    For Debian 10 buster, this problem has been fixed in version     2.2.10-6+deb10u10.

    We recommend that you upgrade your cups packages.

    For the detailed security status of cups please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/cups

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:2002-1 advisory.

    - CVE-2024-35235: Fixed a bug in cupsd that could allow an attacker to change the permissions of other     files in the system. (bsc#1225365)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:2003-1 advisory.

    - CVE-2024-35235: Fixed a bug in cupsd that could allow an attacker to change the permissions of other     files in the system. (bsc#1225365)
    - Handle local 'Negotiate' authentication response for cli clients (bsc#1223179)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of cups installed on the remote host is prior to 2.4.9. It is, therefore, affected by a vulnerability as referenced in the SSA:2024-163-02 advisory.

    New cups packages are available for Slackware 15.0 and -current to fix a security issue.

Tenable has extracted the preceding description block directly from the cups security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
201533	AlmaLinux 8 : cups (ALSA-2024:4265)	Nessus	Alma Linux Local Security Checks	medium
201336	Oracle Linux 8 : cups (ELSA-2024-4265)	Nessus	Oracle Linux Local Security Checks	medium
201292	RHEL 8 : cups (RHSA-2024:4265)	Nessus	Red Hat Local Security Checks	medium
201224	Fedora 40 : cups (2024-a3d1f80409)	Nessus	Fedora Local Security Checks	medium
200879	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 23.10 / 24.04 LTS : CUPS vulnerability (USN-6844-1)	Nessus	Ubuntu Local Security Checks	medium
200497	Debian dla-3826 : cups - security update	Nessus	Debian Local Security Checks	medium
200463	SUSE SLES12 Security Update : cups (SUSE-SU-2024:2002-1)	Nessus	SuSE Local Security Checks	medium
200460	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : cups (SUSE-SU-2024:2003-1)	Nessus	SuSE Local Security Checks	medium
200369	Slackware Linux 15.0 / current cups Vulnerability (SSA:2024-163-02)	Nessus	Slackware Local Security Checks	medium

Detections

Analytics

CVE-2024-35235

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium