Alan Coopersmith <alan.coopersmith () oracle com> writes: https://heyitsas.im/posts/cups/ discloses: [...] Hopefully not too off-topic but a related issue with CUPS is that it's incredibly difficult to remove in order to harden a system. Under Ubuntu it's installed by default and deeply embedded into things (some packages can't be removed at all, try a 'sudo apt purge libcups' but whatever you do don't hit 'y'), and keeps re-enabling and re-installing itself via different mechanisms (release-upgrade, snap, etc) once removed. So the easy mitigation of "don't do that, then" isn't really available unless you're prepared to spend some time recursively removing, disabling, and locking out everything involved.
Peter.
Null Pointer Dereference vulnerability in the ippreadio() function of the CUPS printing system. The flaw is caused by unsafe deserialization and improper validation of crafted printer attribute responses. When ippValidateAttributes() processes such responses, a null pointer dereference occurs, leading to application crash. This issue can be exploited remotely within the local subnet in default configurations, and in some cases over the network if IPP services are exposed. Exploitation requires no authentication or user interaction, allowing attackers to disrupt availability of printing services on affected systems.
Authentication Bypass vulnerability in the authorization handling of the CUPS print server. The flaw exists in the cupsdAuthorize() function (scheduler/auth.c) where, if the configured AuthType is anything other than Basic, but the request still includes an Authorization: Basic ... header, the password validation step is skipped. This allows an attacker to bypass authentication checks entirely. By exploiting this issue, an attacker can perform privileged operations, including modifying configuration files, without providing valid credentials. This vulnerability can be exploited remotely depending on the deployment configuration and does not require valid authentication.
CUPS cups-browsed before 2.5b1 will send an HTTP POST request to an arbitrary destination and port in response to a single IPP UDP packet requesting a printer to be added, a different vulnerability than <a href="https://access.redhat.com/security/cve/CVE-2024-47176">CVE-2024-47176</a>. (The request is meant to probe the new printer but can be used to create DDoS amplification attacks.)
On 9/26/24 6:11 PM, Solar Designer wrote: CVE-2024-47176 | cups-browsed <= 2.0.1 binds on UDP INADDRANY:631 trusting any packet from any source to trigger a Get-Printer-Attributes IPP request to an attacker controlled URL. This seems like a plausible and precise description for a vulnerability. <https://github.com/CVEProject/cvelistV5/blob/07723f33d3792d747b650a873346400ca5dc2034/cves/2024/47xxx/CVE-2024-47176.json#L15> and several unrelated CWEs are listed. <https://cve.mitre.org/cve/listrulesandguidance/countingrules.html>
-- Will Dormann | Senior Vulnerability Analyst
ANALYGENCE, Inc. 8115 Maple Lawn Blvd., Suite 110, Fulton, MD 20759 t 412.818.3452 | f 301.812.4252 e will.dormann () analygence com | w analygence.com
On Thu, Sep 26, 2024 at 03:43:23PM -0700, Alan Coopersmith wrote: On 9/26/24 15:11, Solar Designer wrote: A lot of drama around the disclosure of those issues was going on for maybe a month now, with public tweets about the disclosure process and the issues affecting many distros but excluding detail on the issues (not even CUPS was specifically mentioned until very recently). Per those tweets, the issues were communicated to some distro vendors via CERT/CC VINCE and a vendor planned to bring them to the distros list on September 30 with public disclosure on October 6. Unfortunately, the information leaked prematurely and thus Simone decided on full public disclosure today at 20:00 UTC pre-announcing it only 2 hours in advance. Once it was learned that the information was leaked, the vendors suggested ending the embargo today, and both evilsocket & OpenPrinting agreed to it, with the coordinated end at 20:00 UTC. Thanks Alan! On Twitter, Alan further clarified that "once it was clear the info was out there, the distro makers wanted to end the embargo so they could publish advisories telling users to disable cups-browsed instead of waiting for patches to be available - those with VINCE access had hours of prior notice, not just two."
I apologize to Simone for the unnecessary and wrong guess on whose decision it was. I didn't have that information and shouldn't have included a guess. OpenPrinting has started publishing fixes as well now:
CVE-2024-47175: https://github.com/OpenPrinting/libppd/commit/d681747ebf CVE-2024-47076: https://github.com/OpenPrinting/libcupsfilters/commit/95576ec3
and a temporary workaround for CVE-2024-47176 in: https://github.com/OpenPrinting/cups-browsed/commit/1debe6b140c Thanks. I guess also this from a few days ago? -
https://github.com/OpenPrinting/cups/commit/8361420cbbfa2e729545c4c537c49fc6322c9631
"Escape localized strings in PPDs", which is similar to the last hunk in "Prevent PPD generation based on invalid IPP response" CVE-2024-47175 libppd commit referenced by Alan above.
Possibly unrelated to today's disclosure but also security-relevant is:
https://github.com/OpenPrinting/cups/commit/e3467edf3be2d20a022495d9726a741e36768caf
"Update httpConnectURI to do X.509 pinning, and use it when doing the IPP"
Zdenek, I hope you will soon clarify which commits fix what issues, to assist with distro backports. I understand you're still busy getting these in now and it's probably night time for you, so follow up when you have a moment later, please.
Thanks,
Alexander
A remote attacker who has successfully installed or hijacked an exposed printer (via UPD or mDNS) and was able to return a malicious IPP attribute, the attacker may be able to exploit FoomaticRIPCommandLine to execute arbitrary commands. Due to a lack of sanitization in cfGetPrinterAttributes API and ppdCreatePPDFromIPP2, a vulnerable CUPS system will execute the foomatic-rip filter binary when a print job is sent to the printer.
On 6/13/24 08:49, Tavis Ormandy wrote: On 2024-06-11, Zdenek Dohnal wrote: ???????? Impact
Given that cupsd is often running as root, this can result in the change of permission of any user or system files to be world writable.
https://github.com/OpenPrinting/cups/commit/a436956f3 This is a pretty confusing description... if we accept the premise that an attacker can somehow get root to run cupsd with a modified configuration file (how???), then this patch doesn't seem sufficient. They can still get root to unlink() an arbitrary file, no?
On 2024-06-11, Zdenek Dohnal wrote: ???????? Impact
Given that cupsd is often running as root, this can result in the change of permission of any user or system files to be world writable.
https://github.com/OpenPrinting/cups/commit/a436956f3 This is a pretty confusing description... if we accept the premise that an attacker can somehow get root to run cupsd with a modified configuration file (how???), then this patch doesn't seem sufficient. They can still get root to unlink() an arbitrary file, no?
I guess someone from CUPS has seen a working Ubuntu exploit that did this, but this really feels like fixing the bug in the wrong place?
Tavis.
-- o) $ lynx lock.cmpxchg8b.com /\\ o) o) $ finger taviso () sdf org \V ( ) ( ) @taviso
Hi all,
there is the same vulnerability in CUPS and libppd projects.
The original CUPS report:
CVE-2023-4504: OpenPrinting CUPS Postscript Parsing Heap Overflow Any questions about this disclosure should be directed to cve () takeonme org.
Executive Summary Technical Details Snippet of the vulnerable code:
cups/cups/raster-interpret.c
|L///KFwAY3V1ZQ== |
Attacker Value Credit CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:N
========================================================================================
Notes:
Updated Notes: Commits fixing the issue:
cups: https://github.com/OpenPrinting/cups/commit/2431caddb7e6
libppd: https://github.com/OpenPrinting/libppd/commit/262c909ac5
Have a nice day,
Zdenek Dohnal
CUPS 2.4.x release manager
-- Zdenek Dohnal Senior Software Engineer Red Hat, BRQ-TPBC
A logic issue was addressed with improved state management. This issue is fixed in Security Update 2022-003 Catalina, macOS Monterey 12.3, macOS Big Sur 11.6.5. An application may be able to gain elevated privileges.
cups (Common Unix Printing System) 'Listen localhost:631' option not honored correctly which could provide unauthorized access to the system
The session cookie generated by the CUPS web interface was easy to guess on Linux, allowing unauthorized scripted access to the web interface when the web interface is enabled. This issue affected versions prior to v2.2.10.
It was found that a local attacker can perform limited reads of arbitrary files as root by manipulating cupsd.conf.
Upstream patch:
https://github.com/apple/cups/commit/d47f6aec436e0e9df6554436e391471097686ecc
Affected versions of CUPS allow for the SetEnv and PassEnv directives to be specified in the cupsd.conf file, which is editable by non-root users using the cupsctl binary. This allows attacker-controlled environment variables to be passed to CUPS backends, some of which are run as root. By passing malicious values in environment variables to affected backends, it is possible to execute an attacker-supplied binary as root, subject to sandbox restrictions.
References:
https://blog.gdssecurity.com/labs/2018/7/11/cups-local-privilege-escalation-and-sandbox-escapes.html
Upstream patch:
https://github.com/apple/cups/commit/d47f6aec436e0e9df6554436e391471097686ecc
Last updated 25 August 2025
A flaw was found in CUPS. A localhost.localdomain whitelist entry in validhost() in scheduler/client.c in CUPS before 2.2.2 allows remote attackers to execute arbitrary IPP commands by sending POST requests to the CUPS daemon in conjunction with DNS rebinding. The localhost.localdomain name is often resolved via a DNS server (neither the OS nor the web browser is responsible for ensuring that localhost.localdomain is 127.0.0.1).
External References: https://bugs.chromium.org/p/project-zero/issues/detail?id=1048
Upstream Patch: https://github.com/apple/cups/commit/afa80cb2b457bf8d64f775bed307588610476c41
The following flaw was found in CUPS:
Cupsd uses reference-counted strings with global scope. When parsing a print job request, cupsd over-decrements the reference count for a string from the request. As a result, an attacker can prematurely free an arbitrary string of global scope. They can use this to dismantle ACLs protecting privileged operations, and upload a replacement configuration file, and subsequently run arbitrary code on a target machine.
This bug is exploitable in default configurations, and does not require any special permissions other than the basic ability to print.
Acknowledgements:
Red Hat would like to thank the CERT/CC for reporting this issue.
It was reported [1] that a malformed compressed raster file can trigger a buffer overflow in cupsRasterReadPixels. Upstream git commit that fixes this: https://www.cups.org/strfiles.php/3438/str4551.patch Commited to the upstream cups.git as: 62bd8d91877f4f6f528195192e3d351c60d42e14
[1]: https://www.cups.org/str.php?L4551
Integer underflow in the cupsRasterReadPixels function in filter/raster.c in CUPS before 2.0.2 allows remote attackers to have unspecified impact via a malformed compressed raster file, which triggers a buffer overflow.
It was reported [1] that CUPS does not check that files have world-readable permissions, which allow to local users to obtain sensitive information.
Upstream patches are available at [2] as well.
[1]: http://seclists.org/oss-sec/2014/q3/209 [2]: https://cups.org/str.php?L4455
It was reported [1] that CUPS allow local users to read arbitrary files via symlink attack on the directory index files:
index.html index.class index.pl index.php index.pyc index.py
Upstream patches are available at [2] as well.
[1]: http://seclists.org/oss-sec/2014/q3/209 [2]: https://cups.org/str.php?L4455
It was reported [1] that CUPS does not check that files have world-readable permissions, which allow to local users to obtain sensitive information.
Upstream patches are available at [2] as well.
[1]: http://seclists.org/oss-sec/2014/q3/209 [2]: https://cups.org/str.php?L4455
CUPS before 2.0 allows local users to read arbitrary files via a symlink attack on (1) index.html, (2) index.class, (3) index.pl, (4) index.php, (5) index.pyc, or (6) index.py.
It was reported [1] that a fix for CVE-2014-3537 [2] is not complete. In some cases privilege escalation is still possible [3]. Upstream patches are available at [3] as well.
[1]: http://seclists.org/oss-sec/2014/q3/209 [2]: https://cups.org/str.php?L4450 [3]: https://cups.org/str.php?L4455
It was reported [1] that a fix for CVE-2014-3537 [2] is not complete. In some cases privilege escalation is still possible [3]. Upstream patches are available at [3] as well.
[1]: http://seclists.org/oss-sec/2014/q3/209 [2]: https://cups.org/str.php?L4450 [3]: https://cups.org/str.php?L4455
It was discovered that a local user with privileges of group=lp can write symbolic links in the rss directory and use that to gain '@SYSTEM' group privilege with cupsd.
Permissions:
drwxrwxr-x. 2 root lp 4096 Jul 2 09:58 /var/cache/cups/rss
SELinux mitigates this vulnerability
Cross-site scripting (XSS) vulnerability in scheduler/client.c in Common Unix Printing System (CUPS) before 1.7.2 allows remote attackers to inject arbitrary web script or HTML via the URL path, related to the ispathabsolute function.
lppasswd in CUPS before 1.7.1, when running with setuid privileges, allows local users to read portions of arbitrary files via a modified HOME environment variable and a symlink attack involving .cups/client.conf.
CUPS 1.4.4, when running in certain Linux distributions such as Debian GNU/Linux, stores the web interface administrator key in /var/run/cups/certs/0 using certain permissions, which allows local users in the lpadmin group to read or write arbitrary files as root by leveraging the web interface.