cups-browsed binds to `INADDR_ANY:631`, trusting any packet from any source
82Vexday Risk Score
Patch now. It exploitation observed by VulnCheck and has a working public exploit.
ssvc Actcvss 5.3epss 50%
from disclosure to weapon0 days
exploitation probability
50%top 1% of all CVEs
observed exploitation
yesVulnCheck
11 public exploit(s)
In short
cups-browsed listens on all network interfaces (INADDR_ANY) on port 631 and accepts printer discovery packets from any source without verification. An attacker can send malicious printer information to trigger vulnerable code paths that, combined with other flaws, may lead to remote command execution.
Technical detail
cups-browsed binds to INADDR_ANY:631 and processes untrusted IPP (Internet Printing Protocol) packets without source validation, allowing an attacker on the network to send crafted Get-Printer-Attributes requests. This network exposure, combined with chaining vulnerabilities CVE-2024-47076, CVE-2024-47175, and CVE-2024-47177, enables remote code execution when a user interacts with a malicious printer advertisement.
Summary generated and translated by AI from the official description.
CUPS is a standards-based, open-source printing system, and `cups-browsed` contains network printing functionality including, but not limited to, auto-discovering print services and shared printers. `cups-browsed` binds to `INADDR_ANY:631`, causing it to trust any packet from any source, and can cause the `Get-Printer-Attributes` IPP request to an attacker controlled URL. When combined with other vulnerabilities, such as CVE-2024-47076, CVE-2024-47175, and CVE-2024-47177, an attacker can execute arbitrary commands remotely on the target machine without authentication when a malicious printer is printed to.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.