CVE: detect and mitigate cups foomatic-rip CVE-2024-47176 2024-47177 #2975
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
https://www.cve.org/CVERecord?id=CVE-2024-47177 GHSA-rj88-6mr5-rcw8 https://www.evilsocket.net/2024/09/26/Attacking-UNIX-systems-via-CUPS-Part-I/ In Summary there are four vulnerabilities: "CUPS is a standards-based, open-source printing system, and `cups-browsed` contains network printing functionality including, but not limited to, auto-discovering print services and shared printers. `cups-browsed` binds to `INADDR_ANY:631`, causing it to trust any packet from any source, and can cause the `Get-Printer-Attributes` IPP request to an attacker controlled URL. When combined with other vulnerabilities, such as CVE-2024-47076, CVE-2024-47175, and CVE-2024-47177, an attacker can execute arbitrary commands remotely on the target machine without authentication when a malicious printer is printed to." The commands are executed through foomatic-rip binary, to detect such executions run the following filter on tetragon JSON events: jq 'select(.process_exec != null) | \ select(.process_exec.parent.binary | contains("foomatic-rip"))' \ /var/log/tetragon/tetragon.log This policy can detect and block foomatic-rip binary from executing commands, however according to CUPS developers: "...we can certainly recommend that people not use Foomatic, but there are likely hundreds of older printer models (before 2010) that are only supported through Foomatic." Signed-off-by: Djalal Harouni <[email protected]>
tixxdz
added
the
release-note/minor
anfedotoff
reviewed
Oct 7, 2024
| - operator: "In" | ||
| values: | ||
| # Add your foomatic-rip paths here | ||
| - "/usr/lib/cups/filter/foomatic-rip" |
There was a problem hiding this comment.
Hi, thanks for nice polity! Maybe we can use Postfix operator and check only cups/filter/foomatic-rip ?
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
https://www.cve.org/CVERecord?id=CVE-2024-47177
GHSA-rj88-6mr5-rcw8 https://www.evilsocket.net/2024/09/26/Attacking-UNIX-systems-via-CUPS-Part-I/
In Summary there are four vulnerabilities:
"CUPS is a standards-based, open-source printing system, and
cups-browsedcontains network printing functionality including, but not limited to, auto-discovering print services and shared printers.cups-browsedbinds toINADDR_ANY:631, causing it to trust any packet from any source, and can cause theGet-Printer-AttributesIPP request to an attacker controlled URL. When combined with other vulnerabilities, such as CVE-2024-47076, CVE-2024-47175, and CVE-2024-47177, an attacker can execute arbitrary commands remotely on the target machine without authentication when a malicious printer is printed to."The commands are executed through foomatic-rip binary, to detect such executions run the following filter on tetragon JSON events:
jq 'select(.process_exec != null) |
select(.process_exec.parent.binary | contains("foomatic-rip"))'
/var/log/tetragon/tetragon.log
This policy can detect and block foomatic-rip binary from executing commands, however according to CUPS developers:
"...we can certainly recommend that people not use Foomatic, but there are likely
hundreds of older printer models (before 2010) that are only supported through
Foomatic."