Looks like its out there now:
https://www.evilsocket.net/2024/09/26/Attacking-UNIX-systems-via-CUPS-Part-I/
Short version (correct me if I’m wrong):
If you have CUPS service cups-browsed on your machine and you for some reason exposed that to the internet (port 631), you are about to get pwned.
EDIT: It also requires the user to print to the malicious fake printer.
Yeah, what a disappointment. This guy brought shame to the security community because he was salty that his vulnerability didn’t get the attention it “deserved”.
Disappointment? Only if you mean the person that came up with FoomaticRIP.
For those who did not read the entire thing, it’s a so called “filter” that converts the document before it’s sent to certain nasty types of printers. Except it’s not executed on the print server. The unauthenticated print server can just ask a client to run it on their side. And it’s designed to be able to execute ANY command.
I can’t think of anything except the kernel that is genuinely obligatory on all Linux systems, including embedded. Not glibc (musl). Not udev (mdev). Not systemd (OpenRC/runit/etc). My guess is that this is another exploit of something the reporter hasn’t realized isn’t mandatory because they’re not familiar with non-mainstream distros. I suppose it could be a kernel issue that Android has specifically patched, but if that’s it it’ll be fixed in short order.
In other words, not exactly holding my breath.
Let’s see if this really affects all Linux systems or if the stars need to align for this to actually be exploitable.
I still remember hearing about a Ring 0 exploit in Windows (I may be misremembering, though) that required Ring 0 access. I think if an attacker has access to Ring 0, you’re already screwed anyway.
I’m switching off my internet until this gets fixed holy shit
We can see you totally didn’t do that. Also how would you even get the update?
That was a bit sarcastic, but my Linux servers are indeed disconnected. I’d create my personal mirror (preferably on BSD and update from there). Now that the cat is out of the bag though, I feel stupid. Really, for CUPS??? Are you kidding me???
Nitter link not working. What’s the jist?
This link should be working.
Quoting from the OP tweet:
* Unauthenticated RCE vs all GNU/Linux systems (plus others) disclosed 3 weeks ago.
* Full disclosure happening in less than 2 weeks (as agreed with devs).
* Still no CVE assigned (there should be at least 3, possibly 4, ideally 6).
* Still no working fix.
* Canonical, RedHat and others have confirmed the severity, a 9.9, check screenshot.
* Devs are still arguing about whether or not some of the issues have a security impact.I’ve spent the last 3 weeks of my sabbatical working full time on this research, reporting, coordination and so on with the sole purpose of helping and pretty much only got patronized because the devs just can’t accept that their code is crap - responsible disclosure: no more.
A 9.9!? Holy shit.