The "9.9" Linux Vulnerability Revealed: It's The Printers

I've always hated cups-browsed

I hate all services that scan my network and auto-add anything.

If you can't figure out what the IP of a printer is and manually add it to your system, maybe you shouldn't have a printer.

All of that said, you either need port 631 open to the WAN (or forwarded) or a compromised local system that can hit port 631.

Not impossible, but also not quite as bad as they make it sound.
 
Yeah this one made me laugh. I was waiting for the "OMG GAWDZ SO BAD LINUX RCE" only to find out it's CUPS. It's not even the kernel. I understand why it's rated 9.9 by the CVSS system but I think it's stupid.

1. You have to have cups-browsed installed and running
2. You have to have CUPS opened to the Internet on port 631
3. If CUPS is open on 631 it has to be un-authenticated

To do all three, you have to be one of the dumbest Linux admin on the planet. You honestly have to TRY to make this happen.
 
Vermillion said:
Yeah this one made me laugh. I was waiting for the "OMG GAWDZ SO BAD LINUX RCE" only to find out it's CUPS. It's not even the kernel. I understand why it's rated 9.9 by the CVSS system but I think it's stupid.

1. You have to have cups-browsed installed and running
2. You have to have CUPS opened to the Internet on port 631
3. If CUPS is open on 631 it has to be un-authenticated

To do all three, you have to be one of the dumbest Linux admin on the planet. You honestly have to TRY to make this happen.
Click to expand...
The problem isn't Linux admins, the problem is that most distros for non linux people probably do all that by default. IIRC mint just one day started seeing my network printer after I updated. It was on a VM box so I didn't really care to check it but no one outside my local net could get to 631 but there could be quite a number of people with this in plain view on their laptops just walking around and didn't even know that cups-browsed was even running after they updated their distro.
 
I would think cups isn't on most Linux or UNIX boxes. Most boxes don't need to print and shouldn't have it installed. And I don't think it's one of those packages that ends up as a dependency.

But desktop distros probably put it on by default.
 
toast0 said:
I would think cups isn't on most Linux or UNIX boxes. Most boxes don't need to print and shouldn't have it installed. And I don't think it's one of those packages that ends up as a dependency.

But desktop distros probably put it on by default.
Click to expand...
I've noticed, at least back when I used it, ubuntu tended to pull in lots of dependencies over time, either from updates or as "optional" deps for packages you installed yourself. And ubuntu enables most service by default. I'm sure it's not just ubuntu, that's just one example.

That said, I've never seen cups-browsed pulled in, iirc it's not in the base/extra repos, but I'm not certain.
 
I wonder if Nobara has this on by default. My Nobara install is still running SD all the time in another room.
 
Study finds that Linux computers with open ssh port with no root password and Apache homepage that says hack me please are vulnerable. Thus proving how unsafe Linux is. This is like one of those news stories that says thieves can steal your car using just a comb, so long as they have the keys to get in your car and start it.
 
westrock2000 said:
Study finds that Linux computers with open ssh port with no root password and Apache homepage that says hack me please are vulnerable.
Click to expand...

All of this is wrong. This affects a majority of Linux installs. And most Linux installs don't have admins or firewalls.
 
Axman said:
All of this is wrong. This affects a majority of Linux installs. And most Linux installs don't have admins or firewalls.
Click to expand...

It's somewhere in between.

Most Linux boxes are on local networks that do not expose port 631 to the WAN.

They could be vulnerable to attacks from local machines that have been compromised though.

Its a real flaw, and it needs to be addressed, but it's not like every linux box out there is about to be compromised.

Most linux boxes don't even use any kind of printing. Only desktop linux devices would have any use for that, and they are the distinct minority.
 
Axman said:
This affects a majority of Linux installs.
Click to expand...

I mean, facebook has a crap ton of machines running Linux and while they run a lot of dumb stuff on them, they don't run cups. Pretty sure google doesn't run cups on their machines either, but I don't have hands on experience with theirs. I get that desktop distributions would run cups by default. But most of linux is either servers or androids, and most of desktop linux is chrome OS (which I think has cups for a few years now, but not sure if it runs this part of cups)
 
toast0 said:
they don't run cups
Click to expand...

No, that's the thing, they do unless they're turned off, or firewalled. They aren't, which is why this is a 9.9. This isn't some "Linux is bad" hypebeast, this is a core flaw. It's not desktop distros, it's just distros.
 
Axman said:
No, that's the thing, they do unless they're turned off, or firewalled. They aren't, which is why this is a 9.9. This isn't some "Linux is bad" hypebeast, this is a core flaw. It's not desktop distros, it's just distros.
Click to expand...
I'm not sure I agree there.

I have about 12 *nix servers, a mix of Ubuntu Servers, Debian and FreeBSD. Also, there are a couple of Proxmox hosts. None of them have CUPS installed, and it's not because I manually uninstalled it. CUPS just does not get installed on these machines by the default installer.

The CUPS packages usually just aren't installed on non-desktop machines by default. And unless you are doing something very weird, you wouldn't manually install CUPS on a non-desktop machine that requires printing either.

This is a real potential issue for desktop linux installs, most of which install CUPS by default in order to be user friendly. (This wasn't always the case, but in the last 5-10 years pretty much all of them do). Very few desktop linux machines will be directly exposed to the WAN though, and will instead be on a local network that is by default firewalled off at the router/firewall level and will not allow incoming port 631 traffic.

The only real risk here is that these machines are indirectly attacked by other compromised machines already on the local network, which is a real issue, but just not as big of an issue as originally suggested here.
 
Last edited:
This one was blown way out of proportion... a few things.
https://ubuntu.com/blog/cups-remote-code-execution-vulnerability-fix-available
First here is the Ubuntu fix for this one. This is something that really needs local access to exploit... and a poorly setup local network with full print support and active printing.
"Over any network, including the Internet, a legacy UDP-based protocol can be used to register a new printer with a malicious PPD file. This requires the attacker to be able to send a UDP datagram to port 631, handled by cups-browsed, on the target host. A firewall (or NAT router) can prevent this attack vector."
"Who is affected

CUPS or, more specifically, cups-browsed is generally installed on desktop computers and servers configured as print servers. The exploit chain is not completed unless a print job is sent – so if you never print, no command execution could have happened, even if the vulnerable packages were installed and a malicious actor attempted the exploit.

We recommend that anyone that has the affected packages installed apply the security update as soon as possible. Servers without appropriate firewall rules and laptop computers that may connect to untrusted networks are particularly at risk."

Obviously everyone should update their systems as the fixes for this are out for every distro. Most distros including desktop ones in general don't install cups by default... though most offer a cups package when you install and sure many new linux people might just click it even if they aren't planning to do any printing. If your walking around with a laptop with CUPS thanks to a distro like Mint... if your not actually printing nothing bad can happen to you. Just update and your golden. I don't think many Linux users skip their updates... and some of those newbie friendly distros like mint have big flashing RED numbers for security updates when they push them.
 
ChadD said:
This one was blown way out of proportion... a few things.
https://ubuntu.com/blog/cups-remote-code-execution-vulnerability-fix-available
First here is the Ubuntu fix for this one. This is something that really needs local access to exploit... and a poorly setup local network with full print support and active printing.
"Over any network, including the Internet, a legacy UDP-based protocol can be used to register a new printer with a malicious PPD file. This requires the attacker to be able to send a UDP datagram to port 631, handled by cups-browsed, on the target host. A firewall (or NAT router) can prevent this attack vector."
"Who is affected

CUPS or, more specifically, cups-browsed is generally installed on desktop computers and servers configured as print servers. The exploit chain is not completed unless a print job is sent – so if you never print, no command execution could have happened, even if the vulnerable packages were installed and a malicious actor attempted the exploit.

We recommend that anyone that has the affected packages installed apply the security update as soon as possible. Servers without appropriate firewall rules and laptop computers that may connect to untrusted networks are particularly at risk."

Obviously everyone should update their systems as the fixes for this are out for every distro. Most distros including desktop ones in general don't install cups by default... though most offer a cups package when you install and sure many new linux people might just click it even if they aren't planning to do any printing. If your walking around with a laptop with CUPS thanks to a distro like Mint... if your not actually printing nothing bad can happen to you. Just update and your golden. I don't think many Linux users skip their updates... and some of those newbie friendly distros like mint have big flashing RED numbers for security updates when they push them.
Click to expand...

I - for one - just hate everything auto-detect on a network.

Well, except maybe DHCP. :p

DHCP is actually useful.

For everything else I would rather manually set the IP of a device, and then manually enter that IP on my computer in order to connect to that device.

All of this modern Zeroconf/Bonjour/multicastDNS bullshit drives me up a goddamn tree. It is just asking for trouble. IMHO networking would be better if broadcast/multicast would just go die in a fire. (Except for as used by DHCP :p )

I don't want my computer to ever try to connect to anything on either my local network or the WAN without me explicitly telling it to.

Automation is fine if I personally enable/configure the goddamn automation. Absolutely nothing should ever be enabled by default.

Without me telling my computer to, it should be completely ignoring the fact that it is connected to a network. It should negotiate an IP address with the DHCP server and then sit there ignoring that the network exists. Not a single packet should be leaving the machine and any incoming packet should be silently dropped.

My computer should never be communicating with anything else without me actively knowing about it.

If this were the default behavior for every single device that connects to a network, these kinds of security problems wouldn't exist.

If someone can't figure out the IP of their printer, and manually add it on their computer, then maybe they shouldn't be using computers.
 
Apart from Ubuntu (and derivatives), most properly secured desktop distros don't try to enable this "exploratory" type of thing. Should be up the administrator.
 
I just assumed most wireless printers used mDNS or Apple Bonjour for discovery. Guess wired printers are still a thing.
 
Just looking on this Ubuntu VM and the firewall is off by default when You install (same for Mint and Arch... and ???) OTOH CUPS seems to be up and running by default, it is only listening on the loop back address however.

1727710772945.png
 
atarione said:
Just looking on this Ubuntu VM and the firewall is off by default when You install (same for Mint and Arch... and ???) OTOH CUPS seems to be up and running by default, it is only listening on the loop back address however.

View attachment 682666
Click to expand...

Yeah, I think most desktop distributions will enable CUPS by default, and most will not have a local firewall by default.

In linux circles It is typically only considered necessary if you have a publicly exposed IP address.

For shits and giggles I just portscanned my desktop:
Code: 
nmap -p 0-65535 ip.ip.ip.ip
Starting Nmap 7.80 ( https://nmap.org ) at 2024-09-30 14:08 EDT
Nmap scan report for ip.ip.ip.ip
Host is up (0.00010s latency).
Not shown: 65535 closed ports
PORT    STATE SERVICE
111/tcp open  rpcbind

Nmap done: 1 IP address (1 host up) scanned in 1.24 seconds

As you can see there isn't much there, only rpcbind which I would need to be open on the local network anyway, so blocking it with a firewall wouldn't be helpful.

Rpcbind is often scanned by attackers to try to identify the OS though, but it looks like you can't even get that out of this rpcbind instance.

Code: 
$ nmap -A ip.ip.ip.ip
Starting Nmap 7.80 ( https://nmap.org ) at 2024-09-30 14:10 EDT
Nmap scan report for ip.ip.ip.ip
Host is up (0.00015s latency).
Not shown: 999 closed ports
PORT    STATE SERVICE VERSION
111/tcp open  rpcbind 2-4 (RPC #100000)
| rpcinfo:
|   program version    port/proto  service
|   100000  2,3,4        111/tcp   rpcbind
|   100000  2,3,4        111/udp   rpcbind
|   100000  3,4          111/tcp6  rpcbind
|_  100000  3,4          111/udp6  rpcbind

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 6.32 seconds

The truth is, if you trust your local machine to not be opening surprise ports, then you have very little use for a local firewall. It won't do much that the network wide firewall wont.
 
Last edited:
atarione said:
Just looking on this Ubuntu VM and the firewall is off by default when You install (same for Mint and Arch... and ???) OTOH CUPS seems to be up and running by default, it is only listening on the loop back address however.

View attachment 682666
Click to expand...
You need to look for the cups-browsed service. That's the one you need to stop/disable via systemctl.
 
Zarathustra[H] said:
I - for one - just hate everything auto-detect on a network.

Well, except maybe DHCP. :p

DHCP is actually useful.

For everything else I would rather manually set the IP of a device, and then manually enter that IP on my computer in order to connect to that device.

All of this modern Zeroconf/Bonjour/multicastDNS bullshit drives me up a goddamn tree. It is just asking for trouble. IMHO networking would be better if broadcast/multicast would just go die in a fire. (Except for as used by DHCP :p )

I don't want my computer to ever try to connect to anything on either my local network or the WAN without me explicitly telling it to.

Automation is fine if I personally enable/configure the goddamn automation. Absolutely nothing should ever be enabled by default.

Without me telling my computer to, it should be completely ignoring the fact that it is connected to a network. It should negotiate an IP address with the DHCP server and then sit there ignoring that the network exists. Not a single packet should be leaving the machine and any incoming packet should be silently dropped.

My computer should never be communicating with anything else without me actively knowing about it.

If this were the default behavior for every single device that connects to a network, these kinds of security problems wouldn't exist.

If someone can't figure out the IP of their printer, and manually add it on their computer, then maybe they shouldn't be using computers.
Click to expand...
This sort of stuff is why I have an HPE Aruba ClearPass license. So even if all those things are auto broadcasting and auto detecting and all that jazz it can still have access rules applied on the local network.

Too many bad things out there.
 
Zarathustra[H] said:
I just port scanned my Color LaserJet for shits and giggles.

Know that if you do this, it can waste a lot of paper :p
Click to expand...
had an HVAC team in once and they couldn’t connect to their hardware so they ran some detection to to locate them.
Turns out their maintenance port somehow got programmed for the wrong VLAN 16 instead of 64.
The tool set off all the printers and the lot of them started spitting out paper.
The worst was an IM 5200 which holds some 12,000 pages.
They ran the lot of them dry with a single / in the upper left corner of each.
 
I just checked. Two of my Linux laptops, which use a desktop, do have cups installed as a dependency (I never requested it).

A light headless machine does not have it.
 
Vermillion said:
Yeah this one made me laugh. I was waiting for the "OMG GAWDZ SO BAD LINUX RCE" only to find out it's CUPS. It's not even the kernel. I understand why it's rated 9.9 by the CVSS system but I think it's stupid.

1. You have to have cups-browsed installed and running
2. You have to have CUPS opened to the Internet on port 631
3. If CUPS is open on 631 it has to be un-authenticated

To do all three, you have to be one of the dumbest Linux admin on the planet. You honestly have to TRY to make this happen.
Click to expand...

well, lucky Shodan is there to do most of the heavy lifting. If there's something dumb to do, someone's probably done it.

Go query something like

port:631 "CUPS" -http.auth

And you'll probably find oodles.
 
socK said:
well, lucky Shodan is there to do most of the heavy lifting. If there's something dumb to do, someone's probably done it.

Go query something like

port:631 "CUPS" -http.auth

And you'll probably find oodles.
Click to expand...

I'm sure some people have forwarded port 631. After all IPP was marketed as the "internet printing protocol" after all, and you can technically send print jobs to any IP address. And IPP started out unauthenticated/unencrypted before it migrated into IPPS, so there could technically be lots of vintage unupdated implementations out there. Though they tend to go in the opposite direction, from client to printer, not with port forwards to client/desktop machines. Doing that wouldn't make very much sense.

I'd imagine using port 631 to attach aging printers with unupdated firmware would be more of a problem, but what do I know.

I think it would require a combination of enough knowledge to mess with port forwards (or opening ports through a firewall with IPV6) while at the same time not enough knowledge as to what that means.

I'm not sure how large the overlap in that Venn diagram is, though I am sure there are some.
 
You must log in or register to reply here.
Back
Top