Package: cups
Version: 2.4.10-1
Severity: grave
Tags: security
Justification: user security hole
X-Debbugs-Cc: Debian Security Team
team@security.debian.org
From
https://nvd.nist.gov/vuln/detail/CVE-2024-47176:
CUPS is a standards-based, open-source printing system, and
`cups-browsed` contains network printing functionality including, but
not limited to, auto-discovering print services and shared
printers. `cups-browsed` binds to `INADDR_ANY:631`, causing it to
trust any packet from any source, and can cause the
`Get-Printer-Attributes` IPP request to an attacker controlled
URL. Due to the service binding to `*:631 ( INADDR_ANY )`, multiple
bugs in `cups-browsed` can be exploited in sequence to introduce a
malicious printer to the system. This chain of exploits ultimately
enables an attacker to execute arbitrary commands remotely on the
target machine without authentication when a print job is
started. This poses a significant security risk over the
network. Notably, this vulnerability is particularly concerning as it
can be exploited from the public internet, potentially exposing a vast
number of systems to remote attacks if their CUPS services are
enabled.
-- System Information:
Debian Release: trixie/sid
APT prefers testing
APT policy: (500, 'testing')
Architecture: amd64 (x86_64)
Kernel: Linux 6.10.11-amd64 (SMP w/4 CPU threads; PREEMPT)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled
Versions of packages cups depends on:
ii cups-client 2.4.10-1
ii cups-common 2.4.10-1
ii cups-core-drivers 2.4.10-1
ii cups-daemon 2.4.10-1
ii cups-filters 1.28.17-4.1+b1
ii cups-ppdc 2.4.10-1
ii cups-server-common 2.4.10-1
ii debconf [debconf-2.0] 1.5.87
ii ghostscript 10.04.0~dfsg-1
ii libavahi-client3 0.8-13+b2
ii libavahi-common3 0.8-13+b2
ii libc6 2.40-2
ii libcups2t64 2.4.10-1
ii libgcc-s1 14.2.0-3
ii libstdc++6 14.2.0-3
ii libusb-1.0-0 2:1.0.27-1
ii poppler-utils 24.08.0-2
ii procps 2:4.0.4-5
Versions of packages cups recommends:
ii avahi-daemon 0.8-13+b2
ii colord 1.4.7-1+b1
Versions of packages cups suggests:
ii cups-bsd 2.4.10-1
ii foomatic-db 20230202-1
ii printer-driver-cups-pdf [cups-pdf] 3.0.1-18
ii smbclient 2:4.21.0+dfsg-1
ii udev 256.6-1
-- debconf information:
cupsys/backend: lpd, socket, usb, snmp, dnssd
cupsys/raw-print: true
--
Ron Murray
Systems Administrator,
Enterprise Messaging/Security,
Massachusetts Department of Revenue
(617) 655-3296
PGP Fingerprint: 5A26 A211 68D9 E5AA 176A 1AA3 7A89 5E0B 040A 7431