CVE-2024-47176

NameCVE-2024-47176
DescriptionCUPS is a standards-based, open-source printing system, and `cups-browsed` contains network printing functionality including, but not limited to, auto-discovering print services and shared printers. `cups-browsed` binds to `INADDR_ANY:631`, causing it to trust any packet from any source, and can cause the `Get-Printer-Attributes` IPP request to an attacker controlled URL. When combined with other vulnerabilities, such as CVE-2024-47076, CVE-2024-47175, and CVE-2024-47177, an attacker can execute arbitrary commands remotely on the target machine without authentication when a malicious printer is printed to.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-3905-1, DSA-5778-1
Debian Bugs1082820

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
cups-filters (PTS)bullseye1.28.7-1+deb11u2vulnerable
bullseye (security)1.28.7-1+deb11u3fixed
bookworm1.28.17-3vulnerable
bookworm (security)1.28.17-3+deb12u1fixed
sid, trixie1.28.17-5fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
cups-filterssourcebullseye1.28.7-1+deb11u3DLA-3905-1
cups-filterssourcebookworm1.28.17-3+deb12u1DSA-5778-1
cups-filterssource(unstable)1.28.17-51082820

Notes

https://github.com/OpenPrinting/cups-browsed/security/advisories/GHSA-rj88-6mr5-rcw8
https://www.evilsocket.net/2024/09/26/Attacking-UNIX-systems-via-CUPS-Part-I/
Fixed by: https://github.com/OpenPrinting/cups-browsed/commit/1debe6b140c37e0aa928559add4abcc95ce54aa2
Mitigations cover: For servers, stop and remove the cups-browsed package. For
client/desktop systems: Remove 'cups' from the "BrowseRemoteProtocols" line in
/etc/cups/cups-browsed.conf and restart the cups-browsed service.

Search for package or bug name: Reporting problems