Alan Coopersmith <alan.coopersmith () oracle com> writes: https://heyitsas.im/posts/cups/ discloses: [...] Hopefully not too off-topic but a related issue with CUPS is that it's incredibly difficult to remove in order to harden a system. Under Ubuntu it's installed by default and deeply embedded into things (some packages can't be removed at all, try a 'sudo apt purge libcups' but whatever you do don't hit 'y'), and keeps re-enabling and re-installing itself via different mechanisms (release-upgrade, snap, etc) once removed. So the easy mitigation of "don't do that, then" isn't really available unless you're prepared to spend some time recursively removing, disabling, and locking out everything involved.
Peter.
Null Pointer Dereference vulnerability in the ippreadio() function of the CUPS printing system. The flaw is caused by unsafe deserialization and improper validation of crafted printer attribute responses. When ippValidateAttributes() processes such responses, a null pointer dereference occurs, leading to application crash. This issue can be exploited remotely within the local subnet in default configurations, and in some cases over the network if IPP services are exposed. Exploitation requires no authentication or user interaction, allowing attackers to disrupt availability of printing services on affected systems.
Authentication Bypass vulnerability in the authorization handling of the CUPS print server. The flaw exists in the cupsdAuthorize() function (scheduler/auth.c) where, if the configured AuthType is anything other than Basic, but the request still includes an Authorization: Basic ... header, the password validation step is skipped. This allows an attacker to bypass authentication checks entirely. By exploiting this issue, an attacker can perform privileged operations, including modifying configuration files, without providing valid credentials. This vulnerability can be exploited remotely depending on the deployment configuration and does not require valid authentication.
CUPS cups-browsed before 2.5b1 will send an HTTP POST request to an arbitrary destination and port in response to a single IPP UDP packet requesting a printer to be added, a different vulnerability than <a href="https://access.redhat.com/security/cve/CVE-2024-47176">CVE-2024-47176</a>. (The request is meant to probe the new printer but can be used to create DDoS amplification attacks.)
On 9/26/24 6:11 PM, Solar Designer wrote: CVE-2024-47176 | cups-browsed <= 2.0.1 binds on UDP INADDRANY:631 trusting any packet from any source to trigger a Get-Printer-Attributes IPP request to an attacker controlled URL. This seems like a plausible and precise description for a vulnerability. <https://github.com/CVEProject/cvelistV5/blob/07723f33d3792d747b650a873346400ca5dc2034/cves/2024/47xxx/CVE-2024-47176.json#L15> and several unrelated CWEs are listed. <https://cve.mitre.org/cve/listrulesandguidance/countingrules.html>
-- Will Dormann | Senior Vulnerability Analyst
ANALYGENCE, Inc. 8115 Maple Lawn Blvd., Suite 110, Fulton, MD 20759 t 412.818.3452 | f 301.812.4252 e will.dormann () analygence com | w analygence.com
On Thu, Sep 26, 2024 at 03:43:23PM -0700, Alan Coopersmith wrote: On 9/26/24 15:11, Solar Designer wrote: A lot of drama around the disclosure of those issues was going on for maybe a month now, with public tweets about the disclosure process and the issues affecting many distros but excluding detail on the issues (not even CUPS was specifically mentioned until very recently). Per those tweets, the issues were communicated to some distro vendors via CERT/CC VINCE and a vendor planned to bring them to the distros list on September 30 with public disclosure on October 6. Unfortunately, the information leaked prematurely and thus Simone decided on full public disclosure today at 20:00 UTC pre-announcing it only 2 hours in advance. Once it was learned that the information was leaked, the vendors suggested ending the embargo today, and both evilsocket & OpenPrinting agreed to it, with the coordinated end at 20:00 UTC. Thanks Alan! On Twitter, Alan further clarified that "once it was clear the info was out there, the distro makers wanted to end the embargo so they could publish advisories telling users to disable cups-browsed instead of waiting for patches to be available - those with VINCE access had hours of prior notice, not just two."
I apologize to Simone for the unnecessary and wrong guess on whose decision it was. I didn't have that information and shouldn't have included a guess. OpenPrinting has started publishing fixes as well now:
CVE-2024-47175: https://github.com/OpenPrinting/libppd/commit/d681747ebf CVE-2024-47076: https://github.com/OpenPrinting/libcupsfilters/commit/95576ec3
and a temporary workaround for CVE-2024-47176 in: https://github.com/OpenPrinting/cups-browsed/commit/1debe6b140c Thanks. I guess also this from a few days ago? -
https://github.com/OpenPrinting/cups/commit/8361420cbbfa2e729545c4c537c49fc6322c9631
"Escape localized strings in PPDs", which is similar to the last hunk in "Prevent PPD generation based on invalid IPP response" CVE-2024-47175 libppd commit referenced by Alan above.
Possibly unrelated to today's disclosure but also security-relevant is:
https://github.com/OpenPrinting/cups/commit/e3467edf3be2d20a022495d9726a741e36768caf
"Update httpConnectURI to do X.509 pinning, and use it when doing the IPP"
Zdenek, I hope you will soon clarify which commits fix what issues, to assist with distro backports. I understand you're still busy getting these in now and it's probably night time for you, so follow up when you have a moment later, please.
Thanks,
Alexander
On 6/13/24 08:49, Tavis Ormandy wrote: On 2024-06-11, Zdenek Dohnal wrote: ???????? Impact
Given that cupsd is often running as root, this can result in the change of permission of any user or system files to be world writable.
https://github.com/OpenPrinting/cups/commit/a436956f3 This is a pretty confusing description... if we accept the premise that an attacker can somehow get root to run cupsd with a modified configuration file (how???), then this patch doesn't seem sufficient. They can still get root to unlink() an arbitrary file, no?
On 2024-06-11, Zdenek Dohnal wrote: ???????? Impact
Given that cupsd is often running as root, this can result in the change of permission of any user or system files to be world writable.
https://github.com/OpenPrinting/cups/commit/a436956f3 This is a pretty confusing description... if we accept the premise that an attacker can somehow get root to run cupsd with a modified configuration file (how???), then this patch doesn't seem sufficient. They can still get root to unlink() an arbitrary file, no?
I guess someone from CUPS has seen a working Ubuntu exploit that did this, but this really feels like fixing the bug in the wrong place?
Tavis.
-- o) $ lynx lock.cmpxchg8b.com /\\ o) o) $ finger taviso () sdf org \V ( ) ( ) @taviso
Hi all,
there is the same vulnerability in CUPS and libppd projects.
The original CUPS report:
CVE-2023-4504: OpenPrinting CUPS Postscript Parsing Heap Overflow Any questions about this disclosure should be directed to cve () takeonme org.
Executive Summary Technical Details Snippet of the vulnerable code:
cups/cups/raster-interpret.c
|L///KFwAY3V1ZQ== |
Attacker Value Credit CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:N
========================================================================================
Notes:
Updated Notes: Commits fixing the issue:
cups: https://github.com/OpenPrinting/cups/commit/2431caddb7e6
libppd: https://github.com/OpenPrinting/libppd/commit/262c909ac5
Have a nice day,
Zdenek Dohnal
CUPS 2.4.x release manager
-- Zdenek Dohnal Senior Software Engineer Red Hat, BRQ-TPBC
Accounts. A permissions issue was addressed with additional restrictions.
A buffer overflow vulnerability in the function |formatlogline| could allow remote attackers to cause a denial-of-service(DoS) on the affected system (not verified for possible arbitrary code execution). Exploitation of the vulnerability can be triggered when the configuration file |cupsd.conf| sets the value of |loglevel |to |DEBUG|.
A logic issue was addressed with improved state management. This issue is fixed in Security Update 2022-003 Catalina, macOS Monterey 12.3, macOS Big Sur 11.6.5. An application may be able to gain elevated privileges.
cups (Common Unix Printing System) 'Listen localhost:631' option not honored correctly which could provide unauthorized access to the system
Last updated 25 August 2025
A localhost.localdomain whitelist entry in validhost() in scheduler/client.c in CUPS before 2.2.2 allows remote attackers to execute arbitrary IPP commands by sending POST requests to the CUPS daemon in conjunction with DNS rebinding. The localhost.localdomain name is often resolved via a DNS server (neither the OS nor the web browser is responsible for ensuring that localhost.localdomain is 127.0.0.1).
Integer underflow in the cupsRasterReadPixels function in filter/raster.c in CUPS before 2.0.2 allows remote attackers to have unspecified impact via a malformed compressed raster file, which triggers a buffer overflow.
Cross-site scripting (XSS) vulnerability in scheduler/client.c in Common Unix Printing System (CUPS) before 1.7.2 allows remote attackers to inject arbitrary web script or HTML via the URL path, related to the ispathabsolute function.
lppasswd in CUPS before 1.7.1, when running with setuid privileges, allows local users to read portions of arbitrary files via a modified HOME environment variable and a symlink attack involving .cups/client.conf.
Emmanuel Bouillon reported a memory corruption flaw in CUPS daemon. A specially-crafted IPP request can cause daemon to crash or, possibly, execute arbitrary code.
Acknowledgements:
Red Hat would like to thank Emmanuel Bouillon of NATO C3 Agency for reporting this issue.
Sauli Pahlman of CERT-FI provided us with fuzzed PDF file which causes xpdf / poppler PDF parser to crash.
The crash is caused by an attempt to dereference uninitialized Gfx::parser pointer in Gfx::getPos(), which assumes parser is either NULL or valid Parser pointer.
http://cgit.freedesktop.org/poppler/poppler/tree/poppler/Gfx.cc?id=71063d51#n879
CUPS 1.3.x and earlier ships setuid binaries which use environment variables to set the directories in which they operate.
Description of problem: CVE-2009-3553 (bug #530111) has not been completely fixed.
Version-Release number of selected component (if applicable): Versions known to be affected:
cups-1.3.7-11.el54.5 (RHEL-5.4.z) cups-1.3.7-16.el5 (RHEL-5)
Additional info: The cause is that the cupsdDoSelect() function uses one of several implementations depending on the underlying select/poll capabilities of the operating system. For kqueue and epoll implementations, cupsdRemoveSelect() does not immediately decrease the reference count for the file descriptor and instead adds it to the cupsdinactivefds array. File descriptors in that array are finally dereferenced in cupsdStopSelect() (i.e. program termination).
In Red Hat Enterprise Linux, the epoll implementation is used.
The previous fix for CVE-2009-3553 was to check that another reference was held for the file descriptor before calling the writecb function; however, that will always be the case for both the epoll and kqueue implementations.
The correct fix is to check whether the file descriptor is in the cupsdinactivefds array before calling the writecb function.
The JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, Poppler before 0.10.6, and other products allows remote attackers to cause a denial of service (crash) via a crafted PDF file that triggers an out-of-bounds read.
Heap-based buffer overflow in Xpdf 3.02pl2 and earlier, CUPS 1.3.9, and probably other products, allows remote attackers to execute arbitrary code via a PDF file with crafted JBIG2 symbol dictionary segments.
Multiple "input validation flaws" in the JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, Poppler before 0.10.6, and other products allow remote attackers to execute arbitrary code via a crafted PDF file.
Multiple integer overflows in Xpdf 2.x and 3.x and Poppler 0.x, as used in the pdftops filter in CUPS 1.1.17, 1.1.22, and 1.3.7, GPdf, and kdegraphics KPDF, allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PDF file that triggers a heap-based buffer overflow, possibly related to (1) Decrypt.cxx, (2) FoFiTrueType.cxx, (3) gmem.c, (4) JBIG2Stream.cxx, and (5) PSOutputDev.cxx in pdftops/. NOTE: the JBIG2Stream.cxx vector may overlap CVE-2009-1179.
A security flaw was found in the JBIG2 decoder (possibility of freeing of uninitialized memory). An attacker could use this flaw to potentially cause a denial of service (application crash).
Acknowledgements:
Red Hat would like to thank Braden Thomas and Drew Yao of the Apple Product Security team for responsibly reporting this flaw.
Multiple integer overflows and one integer signedness error were found in the JBIG2 decoder. An attacker could use these flaws to cause a denial of service (application crash) via specially-crafted PDF file.
Acknowledgements:
Red Hat would like to thank Braden Thomas and Drew Yao of the Apple Product Security team for responsibly reporting these flaws.
Multiple buffer overflows in the JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, and other products allow remote attackers to cause a denial of service (crash) via a crafted PDF file, related to (1) JBIG2SymbolDict::setBitmap and (2) JBIG2Stream::readSymbolDictSeg.
Aaron Sigel of Apple Product Security reported that CUPS did not check Host: HTTP header in the connections to the daemon. This insufficient checking may be of an advantage as part of some other attack, e.g. DNS rebinding attack (however, for such attack, user's web browser or browser plugin must be prone to the DNS rebinding attack).
Upstream patch adds check for the Host: header used in clients' requests. It also introduced ServerAlias configuration directive, that must be used to allow clients to use additional valid host names besides those set has hostname or hostname's aliases.