4 ms·

A 9.9 CVE has been announced for Linux

73 points by alexzeitler 2y ago

deleted 2y ago
[deleted]
ajdude 2y ago
> A 9.9 CVE has been announced for Linux Remote code execution. No details yet. Heartbleed was 7.5, for reference. This is one of the worst in history. All GNU/Linux systems impacted. Wonder how bad this is.
- Am4TIfIsER0ppos 2y ago
  I wonder if it is genuine or theoretical like specter and meltdown.
- wannacboatmovie 2y ago
  What about non-GNU Linux? Is kernel or userland impacted?
  - sickofparadox 2y ago
    OP mentioned later in the thread that MacOS is supposedly impacted as well, so if its some underlying system I'd imagine de-GNU'd Linux is affected also.
    - _moof 2y ago
      Sounds like it's CUPS?
      - broknbottle 2y ago
        https://github.com/OpenPrinting/cups-browsed/issues/36 https://github.com/OpenPrinting/cups-browsed/issues/36
- 7bit 2y ago
  > Wonder how bad this is. One of the worst in history!
slipperybeluga 2y ago
[dead]
jamwil 2y ago
Announced… where? The tweet has no link and no context.
- vsean 2y ago
  The post is by the guy that discovered and reported the vulnerability.
error9348 2y ago
Original source seems to be https://archive.is/wwoQZ https://archive.is/wwoQZ
- karmakaze 2y ago
  Devs need to include security pervasively (like they have ops for deployments). * Canonical, RedHat and others have confirmed the severity, a 9.9, check screenshot. * Devs are still arguing about whether or not some of the issues have a security impact. > I've spent the last 3 weeks of my sabbatical working full time on this research, reporting, coordination and so on with the sole purpose of helping and pretty much only got patronized because the devs just can't accept that their code is crap - responsible disclosure: no more. With a confirmed 9.9 there's no need to argue, get the top priorities done, work on others on the possibility they need to be released as well. The act of working in them will usually give a clear answer if it could have security impact. Don't have armchair debates. You can't find loopholes if your mindset is that there are none.
- deleted 2y ago
  [deleted]
deleted 2y ago
[deleted]
frankjr 2y ago
> Full disclosure happening at 20:00 UTC today, in a bit more than 2 hours. > Also, to temper some concern about @evilsocket recent research... His bugs are in a thing that none of you should have installed so when it's published, please just uninstall that junk. Hopefully the response of the developer shows how badly you need to remove it. https://x.com/evilsocket/status/1839361276813902240 https://x.com/evilsocket/status/1839361276813902240 https://x.com/jduck/status/1839312872817803570 https://x.com/jduck/status/1839312872817803570
- frankjr 2y ago
  Almost certainly CUPS related.
  - bshipp 2y ago
    From an eating-popcorn perspective, I would find it truly entertaining that a printer package could somehow result in a 9.9 security vulnerability that is somehow worse than heartbleed. How many linux systems actually have cups installed and active?
    - Alex-Programs 2y ago
      My desktop did. It wasn't publicly exposed though. Past tense - I just purged it. I doubt many exposed servers have CUPS. Edit: The article says he did an internet scan showing hundreds of thousands of vulnerable machines.
red-iron-pine 2y ago
still being discussed as of right now. might be a thing, but may also be hype. if it is indeed a thing then keeping it close to the chest is wise until RH, Canonical, etc. can start releasing patches.
broknbottle 2y ago
It's been obvious that it's CUPS as it was reported to affect linux, bsd, macos, etc.. The guy even forked the repo on github a couple weeks ago.. very lukewarm and over hyped imo.. it's a bit sad that the person spent weeks of their vacation on this.. https://github.com/OpenPrinting/cups-browsed/issues/36 https://github.com/OpenPrinting/cups-browsed/issues/36
imhoguy 2y ago
Someone supposedly have reviewed the report and scores it 6.3, they say 9.9 is overblown to bring attention to fix the issue promptly https://slashdot.org/comments.pl?sid=23466721&cid=64817845 https://slashdot.org/comments.pl?sid=23466721&cid=64817845
bshipp 2y ago
https://gist.github.com/stong/c8847ef27910ae344a7b5408d9840ee1 https://gist.github.com/stong/c8847ef27910ae344a7b5408d9840e... Original report Affected Vendor: - OpenPrinting Affected Product - Several components of the CUPS printing system: cups-browsed, libppd, libcupsfilters and cups-filters. Affected Version - All versions <= 2.0.1 (latest release) and master. Significant ICS/OT impact? - no Reporter - Simone Margaritelli [evilsocket@gmail.com] Vendor contacted? - yes The vendor has been notified trough Github Advisories and all bugs have been confirmed: - https://github.com/OpenPrinting/cups-browsed/security/advisories/GHSA-rj88-6mr5-rcw8 https://github.com/OpenPrinting/cups-browsed/security/adviso... - https://github.com/OpenPrinting/libcupsfilters/security/advisories/GHSA-w63j-6g73-wmg5 https://github.com/OpenPrinting/libcupsfilters/security/advi... - https://github.com/OpenPrinting/libppd/security/advisories/GHSA-7xfx-47qg-grp6 https://github.com/OpenPrinting/libppd/security/advisories/G... - https://github.com/OpenPrinting/cups-filters/security/advisories/GHSA-p9rh-jxmq-gq47 https://github.com/OpenPrinting/cups-filters/security/adviso... I'm also in contact with the Canonical security team about these issues. Description - The vulnerability affects many GNU/Linux distributions: [https://pkgs.org/download/cups-browsed https://pkgs.org/download/cups-browsed] Google ChromeOS: https://chromium.googlesource.com/chromiumos/overlays/chromiumos-overlay/+/master/net-print/cups-filters/cups-filters-1.28.5.ebuild#137 https://chromium.googlesource.com/chromiumos/overlays/chromi... Most BSDs: https://man.freebsd.org/cgi/man.cgi?query=cups-browsed.conf&sektion=5&apropos=0&manpath=FreeBSD+13.2-RELEASE+and+Ports https://man.freebsd.org/cgi/man.cgi?query=cups-browsed.conf&... And possibly more. <snip>
- bshipp 2y ago
  How does an attacker exploit this vulnerability? - An attacker can exploit this vulnerability if it can connect to the host via UDP port 631, which is by default bound to INADDR_ANY, in which case the attack can be entirely remote, or if it's on the same network of the target, by using mDNS advertisements. What does an attacker gain by exploiting this vulnerability? - Remote execution of arbitrary commands when a print job is sent to the system printer. How was the vulnerability discovered? - A lot of curiosity (when I noticed the \*:631 UDP bind I was like "wtf is this?!" and went down a rabbit hole ...) and good old source code auditing. Is this vulnerability publicly known? - No, the bugs are not known and the FoomaticRIPCommandLine vulnerability is known to be already patched (it isn't). Is there evidence that this vulnerability is being actively exploited? - Not to the best of my knowledge.
oskarkk 2y ago
A blog post dropped: https://www.evilsocket.net/2024/09/26/Attacking-UNIX-systems-via-CUPS-Part-I/ https://www.evilsocket.net/2024/09/26/Attacking-UNIX-systems...
- bshipp 2y ago
  This is entertaining reading. Although I don't know how pervasive this issue is, from the chunk i have read so far I can see why he was concerned that it was relatively trivial to have a target system accept anything identifying itself as a printer and being able to inject malicious code into the machine. I was going to make fun of him wasting his sabbatical on hacking a printer service but I gotta admit I'd have fallen down the same rabbit hole if I stumbled on it. It's a cool hack.
seanieb 2y ago
"You're probably not vulnerable to the CUPS CVE" https://xeiaso.net/notes/2024/cups-cve/ https://xeiaso.net/notes/2024/cups-cve/

73 points by alexzeitler 2y ago

deleted 2y ago

[deleted]

> A 9.9 CVE has been announced for Linux Remote code execution. No details yet. Heartbleed was 7.5, for reference. This is one of the worst in history. All GNU/Linux systems impacted. Wonder how bad this is.

Am4TIfIsER0ppos 2y ago
I wonder if it is genuine or theoretical like specter and meltdown.
wannacboatmovie 2y ago
What about non-GNU Linux? Is kernel or userland impacted?
- sickofparadox 2y ago
  OP mentioned later in the thread that MacOS is supposedly impacted as well, so if its some underlying system I'd imagine de-GNU'd Linux is affected also.
  - _moof 2y ago
    Sounds like it's CUPS?
    - broknbottle 2y ago
      https://github.com/OpenPrinting/cups-browsed/issues/36 https://github.com/OpenPrinting/cups-browsed/issues/36
7bit 2y ago
> Wonder how bad this is. One of the worst in history!

slipperybeluga 2y ago

[dead]

jamwil 2y ago

Announced… where? The tweet has no link and no context.

vsean 2y ago
The post is by the guy that discovered and reported the vulnerability.

error9348 2y ago

Original source seems to be https://archive.is/wwoQZ https://archive.is/wwoQZ

karmakaze 2y ago
Devs need to include security pervasively (like they have ops for deployments). * Canonical, RedHat and others have confirmed the severity, a 9.9, check screenshot. * Devs are still arguing about whether or not some of the issues have a security impact. > I've spent the last 3 weeks of my sabbatical working full time on this research, reporting, coordination and so on with the sole purpose of helping and pretty much only got patronized because the devs just can't accept that their code is crap - responsible disclosure: no more. With a confirmed 9.9 there's no need to argue, get the top priorities done, work on others on the possibility they need to be released as well. The act of working in them will usually give a clear answer if it could have security impact. Don't have armchair debates. You can't find loopholes if your mindset is that there are none.
deleted 2y ago
[deleted]

deleted 2y ago

[deleted]

frankjr 2y ago

> Full disclosure happening at 20:00 UTC today, in a bit more than 2 hours. > Also, to temper some concern about @evilsocket recent research... His bugs are in a thing that none of you should have installed so when it's published, please just uninstall that junk. Hopefully the response of the developer shows how badly you need to remove it. https://x.com/evilsocket/status/1839361276813902240 https://x.com/evilsocket/status/1839361276813902240 https://x.com/jduck/status/1839312872817803570 https://x.com/jduck/status/1839312872817803570

frankjr 2y ago
Almost certainly CUPS related.
- bshipp 2y ago
  From an eating-popcorn perspective, I would find it truly entertaining that a printer package could somehow result in a 9.9 security vulnerability that is somehow worse than heartbleed. How many linux systems actually have cups installed and active?
  - Alex-Programs 2y ago
    My desktop did. It wasn't publicly exposed though. Past tense - I just purged it. I doubt many exposed servers have CUPS. Edit: The article says he did an internet scan showing hundreds of thousands of vulnerable machines.

red-iron-pine 2y ago

still being discussed as of right now. might be a thing, but may also be hype. if it is indeed a thing then keeping it close to the chest is wise until RH, Canonical, etc. can start releasing patches.

broknbottle 2y ago

It's been obvious that it's CUPS as it was reported to affect linux, bsd, macos, etc.. The guy even forked the repo on github a couple weeks ago.. very lukewarm and over hyped imo.. it's a bit sad that the person spent weeks of their vacation on this.. https://github.com/OpenPrinting/cups-browsed/issues/36 https://github.com/OpenPrinting/cups-browsed/issues/36

imhoguy 2y ago

Someone supposedly have reviewed the report and scores it 6.3, they say 9.9 is overblown to bring attention to fix the issue promptly https://slashdot.org/comments.pl?sid=23466721&cid=64817845 https://slashdot.org/comments.pl?sid=23466721&cid=64817845

bshipp 2y ago

https://gist.github.com/stong/c8847ef27910ae344a7b5408d9840ee1 https://gist.github.com/stong/c8847ef27910ae344a7b5408d9840e... Original report Affected Vendor: - OpenPrinting Affected Product - Several components of the CUPS printing system: cups-browsed, libppd, libcupsfilters and cups-filters. Affected Version - All versions <= 2.0.1 (latest release) and master. Significant ICS/OT impact? - no Reporter - Simone Margaritelli [evilsocket@gmail.com] Vendor contacted? - yes The vendor has been notified trough Github Advisories and all bugs have been confirmed: - https://github.com/OpenPrinting/cups-browsed/security/advisories/GHSA-rj88-6mr5-rcw8 https://github.com/OpenPrinting/cups-browsed/security/adviso... - https://github.com/OpenPrinting/libcupsfilters/security/advisories/GHSA-w63j-6g73-wmg5 https://github.com/OpenPrinting/libcupsfilters/security/advi... - https://github.com/OpenPrinting/libppd/security/advisories/GHSA-7xfx-47qg-grp6 https://github.com/OpenPrinting/libppd/security/advisories/G... - https://github.com/OpenPrinting/cups-filters/security/advisories/GHSA-p9rh-jxmq-gq47 https://github.com/OpenPrinting/cups-filters/security/adviso... I'm also in contact with the Canonical security team about these issues. Description - The vulnerability affects many GNU/Linux distributions: [https://pkgs.org/download/cups-browsed https://pkgs.org/download/cups-browsed] Google ChromeOS: https://chromium.googlesource.com/chromiumos/overlays/chromiumos-overlay/+/master/net-print/cups-filters/cups-filters-1.28.5.ebuild#137 https://chromium.googlesource.com/chromiumos/overlays/chromi... Most BSDs: https://man.freebsd.org/cgi/man.cgi?query=cups-browsed.conf&sektion=5&apropos=0&manpath=FreeBSD+13.2-RELEASE+and+Ports https://man.freebsd.org/cgi/man.cgi?query=cups-browsed.conf&... And possibly more. <snip>

bshipp 2y ago
How does an attacker exploit this vulnerability? - An attacker can exploit this vulnerability if it can connect to the host via UDP port 631, which is by default bound to INADDR_ANY, in which case the attack can be entirely remote, or if it's on the same network of the target, by using mDNS advertisements. What does an attacker gain by exploiting this vulnerability? - Remote execution of arbitrary commands when a print job is sent to the system printer. How was the vulnerability discovered? - A lot of curiosity (when I noticed the \*:631 UDP bind I was like "wtf is this?!" and went down a rabbit hole ...) and good old source code auditing. Is this vulnerability publicly known? - No, the bugs are not known and the FoomaticRIPCommandLine vulnerability is known to be already patched (it isn't). Is there evidence that this vulnerability is being actively exploited? - Not to the best of my knowledge.

oskarkk 2y ago

A blog post dropped: https://www.evilsocket.net/2024/09/26/Attacking-UNIX-systems-via-CUPS-Part-I/ https://www.evilsocket.net/2024/09/26/Attacking-UNIX-systems...

bshipp 2y ago
This is entertaining reading. Although I don't know how pervasive this issue is, from the chunk i have read so far I can see why he was concerned that it was relatively trivial to have a target system accept anything identifying itself as a printer and being able to inject malicious code into the machine. I was going to make fun of him wasting his sabbatical on hacking a printer service but I gotta admit I'd have fallen down the same rabbit hole if I stumbled on it. It's a cool hack.

seanieb 2y ago

"You're probably not vulnerable to the CUPS CVE" https://xeiaso.net/notes/2024/cups-cve/ https://xeiaso.net/notes/2024/cups-cve/