Bug 2314253 (CVE-2024-47076)

Summary:	CVE-2024-47076 cups-filters: libcupsfilters: `cfGetPrinterAttributes` API does not perform sanitization on returned IPP attributes
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	asdas, bmontgom, dpaolell, eparis, erack, gotiwari, jburrell, jdelft, jfrejlac, jhorak, jupierce, jwest, lgarciaa, mbiarnes, mvyas, nstielau, security-response-team, sidsharm, sponnaga, talessio, tpopela, vlaad, ximhan, yuxzhu, zdohnal
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in OpenPrinting CUPS. In certain conditions, a remote attacker can add a malicious printer or directly hijack an existing printer by replacing the valid IPP URL with a malicious one. Also, it is possible that due to a lack of validation of IPP attributes returned by the server, this issue allows attacker-controlled data to be used on the rest of the CUPS system.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2314999, 2315000
Bug Blocks:

Description OSIDB Bzimport 2024-09-23 16:57:13 UTC

If an attacker is able to exploit an exposed IPP server to respond with a valid response to be added to the system, and if discovered via mDNS, an existing printer can be directly hijacked (its IPP url replaced with a malicious one) making it indistinguishable from the original one. The `cfGetPrinterAttributes` API does not perform any sanitization on any of the IPP attributes returned by the server. Attributes that are then saved, as they are, in a temporary PPD file via `ppdCreatePPDFromIPP2`. `ppdCreatePPDFromIPP2` doesn't perform any sanitization itself and in fact it just writes to the file any attributes contents. This allows an attacker to return a malicious IPP attribute in the form of `printer-privacy-policy-uri` (which is just one of the several attributes that can be used, the RCE was also confirmed with `printer-info`, `printer-name` and `printer-make-and-model`).

Comment 1 errata-xmlrpc 2024-09-27 20:12:53 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2024:7346 https://access.redhat.com/errata/RHSA-2024:7346

Comment 2 errata-xmlrpc 2024-10-01 18:22:35 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.2 Advanced Update Support

Via RHSA-2024:7461 https://access.redhat.com/errata/RHSA-2024:7461

Comment 3 errata-xmlrpc 2024-10-01 18:29:22 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.8 Extended Update Support

Via RHSA-2024:7462 https://access.redhat.com/errata/RHSA-2024:7462

Comment 4 errata-xmlrpc 2024-10-01 18:30:48 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2024:7463 https://access.redhat.com/errata/RHSA-2024:7463

Comment 5 errata-xmlrpc 2024-10-02 11:31:54 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions

Via RHSA-2024:7506 https://access.redhat.com/errata/RHSA-2024:7506

Comment 6 errata-xmlrpc 2024-10-02 11:32:10 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.4 Telecommunications Update Service
  Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions

Via RHSA-2024:7504 https://access.redhat.com/errata/RHSA-2024:7504

Comment 7 errata-xmlrpc 2024-10-02 11:55:53 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Extended Update Support

Via RHSA-2024:7503 https://access.redhat.com/errata/RHSA-2024:7503

Comment 8 errata-xmlrpc 2024-10-02 18:18:41 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7.7 Advanced Update Support

Via RHSA-2024:7551 https://access.redhat.com/errata/RHSA-2024:7551

Comment 9 errata-xmlrpc 2024-10-02 18:26:46 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7 Extended Lifecycle Support

Via RHSA-2024:7553 https://access.redhat.com/errata/RHSA-2024:7553

Comment 10 errata-xmlrpc 2024-10-03 11:23:20 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.6 Telecommunications Update Service

Via RHSA-2024:7623 https://access.redhat.com/errata/RHSA-2024:7623