6 ms·
The original CVSS score on Twitter indicated that user interaction was not required. However reading the RCE chain on the page says: Wait for a print job to be
by dfc 2y ago
The original CVSS score on Twitter indicated that user interaction was not required. However reading the RCE chain on the page says:
Wait for a print job to be sent to our fake printer for the PPD directives, and therefore the command, to be executed.
If Alice never hits print it seems like a print job will never be triggered. Am I missing something? I'm not questioning evilsocket, I'm trying to check my understanding.
- rini17 2y agoThere are also buffer overflows which they detected with fuzzer, which can be turned into RCE without requiring user interaction. But author did not have enough expertise in this area to create actual exploit for these.
- cjbprime 2y agoIt is untrue that every buffer overflow can be exploited. We won't know whether these can be until someone tries.
- playingalong 2y agoIt depends on the definition of "interaction". AFAIU Alice doesn't need to print anything supplied by the attacker. It's enough if she prints anything.
- dfc 2y agoI agree that Alice just needs to print anything but that seems like user interaction required. Its also not clear if Alice has multiple printers defined does it matter which printer she selects?
- tsimionescu 2y agoThe attacker can replace any and all printers, so not entirely. I'm not sure how the UI part of CVSS is specifically defined, but I think it's at least somewhat fair to call something the user is expected to do unrelated to the attack in any way "no interaction". Otherwise, it's like saying "the user has to power on their device and turn on their Wi-Fi for the attack to work, so it requires user interaction".
- acdha 2y agoThe question I had is whether the attacker can enumerate known printers, too. Replacement is a lot more damaging if they don’t have to discover the name of your default printer first. The interaction question is complicated because there are three modes: the most damaging is when the attacker can trigger the exploit directly, since that’s where we start seeing worms and other untargeted attacks. The next level is where the attacker can exploit something the user normally does - hence the question about default printer replacement since that is something the user has done many times before and thinks of as safe. The lowest level of risk would be if they need to get you to click on a different printer: still bad but nowhere near as easy to exploit on a large scale.
- kccqzy 2y agoShe needs to print something using the fake printer. Nothing happens, IIUC, if Alice chooses to print a document with a real printer.
- cjbprime 2y agoThe attack can overwrite the real printer with a fake one.
- djordanzachvsd 2y agoin the middle of the alley