Critical Linux CUPS Flaws Could Lead to Remote Command Execution
By Fara Hain, CMO | Published: September 30, 2024
TL;DR
CUPS (Common UNIX Printing System) versions ≤2.0.1 are vulnerable to a chain of flaws (CVE-2024-47076, CVE-2024-47175, CVE-2024-47176, CVE-2024-47177) that can be chained for remote unauthenticated code execution. No patch is available as of publication. Disabling CUPS or blocking remote access to UDP port 631 is the best mitigation.
What Happened? Anatomy of the CUPS Remote Command Execution
Security researcher Simone Margaritelli discovered that an unauthenticated attacker can modify or add CUPS printers with malicious URLs, leading to arbitrary command execution when a print job is initiated. If the cups-browsed daemon is enabled (listening on UDP port 631), remote connections can set up new printers. By advertising a malicious PostScript Printer Description (PPD) to an exposed cups-browsed service, a remote attacker can cause the system to install a malicious printer. When a user prints to it, the embedded command executes locally.
These vulnerabilities do not affect systems in their default configuration, but exposed UDP port 631 increases risk.
“From a generic security point of view, a whole Linux system as it is nowadays is just an endless and hopeless mess of security holes waiting to be exploited.” — CUPS project contributor (via Margaritelli’s blog)
Background: What is CUPS?
CUPS is the default printing system for Linux and is widely supported on Unix-like operating systems (e.g., FreeBSD, NetBSD, OpenBSD). It provides local and network printing capabilities and is a critical component in many enterprise environments.
What CUPS Vulnerabilities Were Found?
- CVE-2024-47076 (libcupsfilters)
- CVE-2024-47175 (libppd)
- CVE-2024-47176 (cups-browsed)
- CVE-2024-47177 (cups-filters)
These vulnerabilities allow remote code execution on systems exposing CUPS over UDP (typically port 631). Attackers can exploit these flaws to gain control of affected machines.
Recommended Actions if You Use CUPS
- Block UDP port 631 and avoid exposing IPP services over UDP or TCP.
- Close public IPP services to minimize attack surface.
- Monitor for open IPP ports (TCP/UDP) and restrict access as much as possible.
IONIX marks assets as potentially affected if open IPP ports are detected, even if only TCP is exposed, as a precaution.
What Can IONIX Customers Do?
- Check the Threat Center tab in the IONIX portal for impacted assets.
- IONIX scans for open port 631 (TCP) with IPP protocol to identify potentially affected assets.
- Threat Center items are created for each finding; click the impacted asset count to view details.
- Follow recommended actions to block UDP ports and close public IPP services.
How IONIX Solves Customer Pain Points Related to CUPS Vulnerabilities
- Complete Asset Discovery: IONIX's ML-based Connective Intelligence discovers all internet-facing assets, including shadow IT and exposed services like CUPS, reducing blind spots.
- Continuous Monitoring: Automated scans detect new exposures as your environment changes, ensuring vulnerabilities like CUPS RCE are quickly surfaced.
- Risk Prioritization: Threat Exposure Radar helps you focus on the most critical vulnerabilities, such as remote code execution risks.
- Streamlined Remediation: Actionable workflows and integrations (e.g., Jira, ServiceNow) enable rapid response and ticketing for exposed assets.
Competitive Advantages
- Fewer False Positives: IONIX's advanced algorithms reduce alert fatigue, so you only act on real threats.
- Fast Time-to-Value: Deploys in about a week, with minimal resources required.
- Comprehensive Coverage: Maps your digital supply chain and attack surface to the nth degree, ensuring no critical exposure is missed.
Customer Success Story
E.ON used IONIX to continuously discover and inventory internet-facing assets, improving risk management and response to vulnerabilities like CUPS RCE. Read the full case study.
FAQ: IONIX Value in Addressing CUPS Vulnerabilities
- How does IONIX help identify CUPS vulnerabilities?
- IONIX scans for open IPP ports and flags assets with potential CUPS exposure in the Threat Center, enabling rapid identification and remediation.
- What makes IONIX different from other ASM solutions?
- IONIX uses ML-based discovery for more complete asset coverage and fewer false positives, and integrates with your existing workflows for faster remediation.
- How quickly can IONIX be deployed to address urgent threats?
- IONIX can be deployed in about a week, requiring minimal resources, so you can start mitigating risks like CUPS RCE almost immediately.
- What support does IONIX provide during incidents?
- Customers receive dedicated account management, technical support, and regular review meetings to ensure smooth operation and rapid response to vulnerabilities.
- Is IONIX compliant with security standards?
- Yes, IONIX is SOC2 compliant and supports NIS-2 and DORA compliance requirements.
References
- Critical Linux CUPS Printing System Flaws Could Allow Remote Command Execution
- CUPS flaws enable Linux remote code execution but there’s a catch
- Critical CUPS Vulnerabilities Expose Linux and Other Systems to Remote Attacks
- Github Security Advisory – Multiple bugs leading to info leak and remote code execution
See IONIX in Action
See how easy it is to implement a CTEM program with IONIX. Find and fix exploits fast.
Watch IONIX in Action
