Frequently asked questions about multiple vulnerabilities in the Common UNIX Printing System (CUPS) that were disclosed as zero-days on September 26.

CVE-2024-47076, CVE-2024-47175, CVE-2024-47176, CVE-2024-47177: Frequently Asked Questions About Common UNIX Printing System (CUPS) Vulnerabilities

CUPS is a standards-based, open-source printing system, and cups-filters provides backends, filters, and other software for CUPS 2.x to use on non-Mac OS systems. Any value passed to `FoomaticRIPCommandLine` via a PPD file will be executed as a user controlled command. When combined with other logic bugs as described in CVE_2024-47176, this can lead to remote command execution.

The remote Fedora 39 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2024-cf6ab63871 advisory.

    Fix for remote vulnerabilities against OpenPrinting cups-filters

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2024-01127974ec advisory.

    Fix for remote vulnerabilities against OpenPrinting cups-filters


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux host has a package installed that is affected by the vulnerabilities as referenced in the RHSB-2024:002 advisory.

  - CUPS is a standards-based, open-source printing system, and `libcupsfilters` contains the code of the     filters of the former `cups-filters` package as library functions to be used for the data format conversion     tasks needed in Printer Applications. The `cfGetPrinterAttributes5` function in `libcupsfilters` does not     sanitize IPP attributes returned from an IPP server. When these IPP attributes are used, for instance, to     generate a PPD file, this can lead to attacker controlled data to be provided to the rest of the CUPS     system. (CVE-2024-47076)

  - CUPS is a standards-based, open-source printing system, and `libppd` can be used for legacy PPD file     support. The `libppd` function `ppdCreatePPDFromIPP2` does not sanitize IPP attributes when creating the     PPD buffer. When used in combination with other functions such as `cfGetPrinterAttributes5`, can result in     user controlled input and ultimately code execution via Foomatic. This vulnerability can be part of an     exploit chain leading to remote code execution (RCE), as described in CVE-2024-47176. (CVE-2024-47175)

  - CUPS is a standards-based, open-source printing system, and `cups-browsed` contains network printing     functionality including, but not limited to, auto-discovering print services and shared printers.
    `cups-browsed` binds to `INADDR_ANY:631`, causing it to trust any packet from any source, and can cause the     `Get-Printer-Attributes` IPP request to an attacker controlled URL. Due to the service binding to `*:631     ( INADDR_ANY )`, multiple bugs in `cups-browsed` can be exploited in sequence to introduce a malicious     printer to the system. This chain of exploits ultimately enables an attacker to execute arbitrary commands     remotely on the target machine without authentication when a print job is started. This poses a significant     security risk over the network. Notably, this vulnerability is particularly concerning as it can be     exploited from the public internet, potentially exposing a vast number of systems to remote attacks if     their CUPS services are enabled. (CVE-2024-47176)

  - CUPS is a standards-based, open-source printing system, and cups-filters provides backends, filters, and     other software for CUPS 2.x to use on non-Mac OS systems. Any value passed to `FoomaticRIPCommandLine` via     a PPD file will be executed as a user controlled command. When combined with other logic bugs as described     in CVE_2024-47176, this can lead to remote command execution. (CVE-2024-47177)

ID	Name	Product	Family	Severity
207880	Fedora 39 : cups / cups-browsed / libcupsfilters / libppd (2024-cf6ab63871)	Nessus	Fedora Local Security Checks	critical
207879	Fedora 40 : cups / cups-browsed / libcupsfilters / libppd (2024-01127974ec)	Nessus	Fedora Local Security Checks	critical
207865	RHEL OpenPrinting cups-filters (RHSB-2024:002)	Nessus	Red Hat Local Security Checks	critical

Detections

Analytics

CVE-2024-47177

critical

Tenable Plugins

critical

critical

critical