A new vulnerability was recently discovered in a widely used print server that is installed by default on many Linux and Unix-based systems with a graphical user interface. The primary attack vector for the vulnerability is the CUPS (Common Unit Printing System) print scheduler, specifically cups-browsed, and has the potential to execute code remotely with zero user interaction required.
The vulnerability has reportedly been given a CVSS score of 9.9 by RHEL and Canonical, although this score is hotly debated, with some arguing it should have a lower score, because, although code can be remotely downloaded to the system, it cannot be executed without user intervention. Fortunately, there is no evidence of the vulnerability having been exploited, although the disclosure was leaked online ahead of a planned private reveal in October, prompting the developer that discovered the vulnerability to post the full explanation in a write-up on their blog. This being the case, the vulnerability could very well start being exploited by malicious actors.
According to the lengthy blog post by the researcher, Simone Margaritelli, services related to the CUPS printing system on are vulnerable to remote code execution. Essentially, an attacking system convinces the print scheduler that it is a printer and sends over malware—which can be arbitrary executable code—that is disguised as a printer configuration file. This process requires no user intervention, since CUPS will accept any packet sent via port *:631. The next time the user attempts to print something, that code can be executed, potentially compromising the system.
The specific exploit depends on a host of unpatched vulnerabilities, some over a decade old, making this a particularly concerning issue for those using Linux or Unix-based. For this attack vector to work, the system needs to have CUPS (Common Unix Printing System) and cups-browsed installed and running, which is the default for a lot of systems. According to Margaritelli, there are 200,000-300,000 systems with the print service currently connected to the internet, although Shodan reports (see above screenshot) that there are around 76,000 systems with open CUPS ports connected to the internet.
While the researcher claims that most GNU/Linux distributions—as well as potentially ChromeOS and macOS—are affected, it should be noted that it is not the default configuration for many Linux distributions, and it especially shouldn't be the case for any large-scale servers or data centers, meaning the largest target group would be private PC users running Linux.
View at TechPowerUp Main Site | Source
The vulnerability has reportedly been given a CVSS score of 9.9 by RHEL and Canonical, although this score is hotly debated, with some arguing it should have a lower score, because, although code can be remotely downloaded to the system, it cannot be executed without user intervention. Fortunately, there is no evidence of the vulnerability having been exploited, although the disclosure was leaked online ahead of a planned private reveal in October, prompting the developer that discovered the vulnerability to post the full explanation in a write-up on their blog. This being the case, the vulnerability could very well start being exploited by malicious actors.
According to the lengthy blog post by the researcher, Simone Margaritelli, services related to the CUPS printing system on are vulnerable to remote code execution. Essentially, an attacking system convinces the print scheduler that it is a printer and sends over malware—which can be arbitrary executable code—that is disguised as a printer configuration file. This process requires no user intervention, since CUPS will accept any packet sent via port *:631. The next time the user attempts to print something, that code can be executed, potentially compromising the system.
The specific exploit depends on a host of unpatched vulnerabilities, some over a decade old, making this a particularly concerning issue for those using Linux or Unix-based. For this attack vector to work, the system needs to have CUPS (Common Unix Printing System) and cups-browsed installed and running, which is the default for a lot of systems. According to Margaritelli, there are 200,000-300,000 systems with the print service currently connected to the internet, although Shodan reports (see above screenshot) that there are around 76,000 systems with open CUPS ports connected to the internet.
While the researcher claims that most GNU/Linux distributions—as well as potentially ChromeOS and macOS—are affected, it should be noted that it is not the default configuration for many Linux distributions, and it especially shouldn't be the case for any large-scale servers or data centers, meaning the largest target group would be private PC users running Linux.
View at TechPowerUp Main Site | Source
