this post was submitted on 29 Sep 2024
42 points (100.0% liked)

Linux

5081 readers
41 users here now

A community for everything relating to the linux operating system

Also check out !linux_memes@programming.dev

Original icon base courtesy of lewing@isc.tamu.edu and The GIMP

founded 1 year ago
MODERATORS
Ategon@programming.dev
anzo@programming.dev
dwraf_of_ignorance@programming.dev
42
The CUPS explout is here: GitHub - RickdeJager/cupshax (github.com)
submitted 2 weeks ago by Blaze@lemmy.zip to c/linux@programming.dev
6 comments fedilink hide all child comments
 

cross-posted from: https://lemmy.zip/post/23601247

I hope this goes without saying but please do not run this on machines you don't own.

The good news:

  • the exploit seems to require user action

The bad news:

  • Device Firewalls are ineffective against this

  • if someone created a malicious printer on a local network like a library they could create serious issues

  • it is hard to patch without breaking printing

  • it is very easy to create printers that look legit

  • even if you don't hit print the cups user agent can reveal lots of information. This may be blocked at the Firewall

TLDR: you should be careful hitting print

top 6 comments
sorted by: hot top controversial new old
[–] Telorand@reddthat.com 15 points 2 weeks ago (1 children)

As other articles pointed out, this is only a problem if:

  • You expose port 631 to the internet.
    • Why would anyone do that?
  • You have a malicious actor on your trusted network.
    • If so, you have bigger problems.
  • You hit "Print" on a compromised network, such as a public library, while using CUPS.

Only the last one is potentially problematic for more people, and even then, the number of people using Linux is still very small. Some libraries don't allow printing or only printing via their computers.

It's good to know this flaw exists, but it doesn't seem like a particularly concerning attack vector.

[–] Hirom@beehaw.org 7 points 2 weeks ago (1 children)
  • You have a malicious actor on your trusted network.
  • If so, you have bigger problems.

This is more likely than you think. There's more computers than you realise on the average network. Many aren't updated and have vulnerabilities. If there's one malware on one machine on your network, that means a malicious actor is on your network.

Common exemples :

  • Home WiFi network with old unpached router, Android smartphone, network printer, security camera, thermostat, robot vacuum cleaner, smart lightbulb, smart TV, ...
  • Unsecure WiFi network at the cafe, train station, hotel, ... where you connect a laptops that is sometimes used for printing and which has CUPS
[–] Telorand@reddthat.com 1 points 2 weeks ago (1 children)

But again, most people aren't running Linux, and for people who are, they're likely more conscientious about connectivity and security patches.

I agree that most people aren't paying attention to every little thing, but the likelihood of someone invading your home network for a tiny payoff, especially when it requires the rare activity of printing something, is probably low-risk.

[–] schizo@forum.uncomfortable.business 2 points 2 weeks ago

But again, most people aren’t running Linux

Exactly. This is bad, for the 0.3% of the computing population that use Linux AND have CUPS installed AND actually print things.

Not exactly a prime target, compared to literally almost anything else. If I were going all-in on something after having gained access to someone's local network, I'm 100% in on any exploit that lets me use an infostealer trojan to steal your session cookies, not fiddling around and hoping you print something.

(Patch your shit anyways, but there's no need to freak out.)

[–] Vivendi@lemmy.zip 13 points 2 weeks ago

If there is ONE project that needs a rewrite in modern C++ OR Rust (or some other 'safe' language) it's FUCKING CUPS

Please, Rust fanatics, do ONE good instead of rewriting GPL programs into a corpo-rat license

[–] FizzyOrange@programming.dev 6 points 2 weeks ago* (last edited 2 weeks ago)

Wow look at that CUPS code and tell me with a straight face there aren't 5 more similar vulnerabilities waiting to be found...