Bug 2315007

Summary:	CVE-2024-47076: cfGetPrinterAttributes5 does not validate or sanitize the IPP attributes returned from an IPP server, providing attacker controlled data to the rest of the CUPS system
Product:	[Fedora] Fedora	Reporter:	Daniel Milnes <daniel>
Component:	libcupsfilters	Assignee:	Zdenek Dohnal <zdohnal>
Status:	CLOSED DUPLICATE	QA Contact:
Severity:	urgent	Docs Contact:
Priority:	unspecified
Version:	rawhide	CC:	ntait, rik.theys, zdohnal
Target Milestone:	---
Target Release:	---
Hardware:	All
OS:	Linux
URL:	https://www.evilsocket.net/2024/09/26/Attacking-UNIX-systems-via-CUPS-Part-I/
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2024-09-26 21:38:57 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Daniel Milnes 2024-09-26 20:15:42 UTC

CVE-2024-47176 | cups-browsed <= 2.0.1 binds on UDP INADDR_ANY:631 trusting any packet from any source to trigger a Get-Printer-Attributes IPP request to an attacker controlled URL.
CVE-2024-47076 | libcupsfilters <= 2.1b1 cfGetPrinterAttributes5 does not validate or sanitize the IPP attributes returned from an IPP server, providing attacker controlled data to the rest of the CUPS system.
CVE-2024-47175 | libppd <= 2.1b1 ppdCreatePPDFromIPP2 does not validate or sanitize the IPP attributes when writing them to a temporary PPD file, allowing the injection of attacker controlled data in the resulting PPD.
CVE-2024-47177 | cups-filters <= 2.0.1 foomatic-rip allows arbitrary command execution via the FoomaticRIPCommandLine PPD parameter.

https://www.evilsocket.net/2024/09/26/Attacking-UNIX-systems-via-CUPS-Part-I/

Still reading through these, but they've been hyped in the press all week. It would appear that they only matter if CUPS is network-exposed.

Reproducible: Always

Comment 1 Nick Tait 2024-09-26 21:38:57 UTC

Closing this as a dupe, in place of the official tracker.

*** This bug has been marked as a duplicate of bug 2314999 ***