A CUPS Vulnerability Explained

A 9.9 Linux CVE was discovered! Heartbleed was only 8.5, so you know that this is something to pay attention to. If you know any server administrators, text them some encouragement as they’ll surely be going through it at work today. Here’s some more detail on what the exploit is: ⬇️

CUPS is the Common Unix Printing System, a general service for printers that is used widely by Unix-like systems, including most distributions of Linux and macOS. The vulnerability was found in its printer discovery service cups-browsed. CUPS listens for packets at port 631 from any host. These packets trigger printer discovery, where CUPS tries to get the printer attributes from this arbitrary server. It can set its own name and the URL for the printing protocol to access, which could be an attacker-controlled host. There is also a printer attribute called FoomaticRIPCommandLine, which arbitrarily executes its string value when a print job is executed. This exists to provide flexibility for systems that need configuration before they can print… but it’s also a huge attack vector and has been the site of multiple previous CVEs.

In essence: any computer connected to the public Internet is vulnerable to an attacker adding a malicious printer to it. If a user executes a print job with the malicious printer, then the arbitrary code, which could be malware, is executed. Keep in mind that the attacker can name the printer whatever they like. How many of you would think twice before printing to “HP DeskJet”?

How is this mitigated? The easiest way to do this is to disable the cups-browsed service. Automatic printer discovery is more of a nice-to-have than a need, and with such a glaring security flaw, the correct decision is obvious. In general, considering how flawed CUPS is, you should avoid printing from Unix-like systems when possible.

Want to know more? The author of the CVE published an excellent article that goes over all of the details of the exploit: Attacking UNIX Systems via CUPS, Part I.