Untitled attachment

Notices where this attachment appears

1. Embed this notice
   screaminggoat (screaminggoat@infosec.exchange)'s status on Friday, 27-Sep-2024 09:49:16 JST screaminggoat

   in reply to

   Evil Socket: Attacking UNIX Systems via CUPS, Part I

   • CVE-2024-47176 cups-browsed <= 2.0.1 binds on UDP INADDR_ANY:631 trusting any packet from any source to trigger a Get-Printer-Attributes IPP request to an attacker controlled URL.
   • CVE-2024-47076 libcupsfilters <= 2.1b1 cfGetPrinterAttributes5 does not validate or sanitize the IPP attributes returned from an IPP server, providing attacker controlled data to the rest of the CUPS system.
   • CVE-2024-47175 libppd <= 2.1b1 ppdCreatePPDFromIPP2 does not validate or sanitize the IPP attributes when writing them to a temporary PPD file, allowing the injection of attacker controlled data in the resulting PPD.
   • CVE-2024-47177 cups-filters <= 2.0.1 foomatic-rip allows arbitrary command execution via the FoomaticRIPCommandLine PPD parameter.

   cc: @chillybot @Viss @evilsocket @morb @cR0w @Enigma