Wait, so how do we print now?
Oh, hey! Wasn’t even a problem for me.
Entirely personal recommendation, take it or leave it: I’ve seen and attacked enough of this codebase to remove any CUPS service, binary and library from any of my systems and never again use a UNIX system to print. I’m also removing every zeroconf / avahi / bonjour listener. You might consider doing the same.
Great advice. It would appear these developers don’t take security seriously.
Mdns is something most people have no idea exists.
Oh, neat, all my devices broadcast all their open ports, services, addresses, hardware and names? Cool!
No.
If your router/firewall is configured to let these broadcasts through you have a problem. If it is working correctly and you have an attacker on your lan? You have already lost.
Udp sent to port 631. Isn’t firewall on router going to block that anyway?
Firewall on everything gonna block that lol
I have cups (but not cups-browsed) installed, but I only start the service when I need to print something a few times a year. Until then it is only a binary sitting in a folder, nothing more.
Worse than the exploit, is hearing the struggles the author faced to report it
Twenty-two days of arguments, condescension, several gaslighting attempts, more or less subtle personal attacks, dozens of emails and messages, more than 100 pages of text in total. Hours and hours and hours and hours and fucking hours. Not to mention somehow being judged by a big chunk of the infosec community with a tendency of talking and judging situations they simply don’t know.
I mean, OK, it’s a vulnerability and there are interesting implications, but this is hardly significant in any pracitcal sense of the word.
the potential victim has to run their system without a firewall, has to print to the printer they’ve never interacted with before and then the attacker can run shit with whatever the printing system’s user id is, which shouldn’t be an issue on any reasonably modern distro.
I routinely remove cups and friends from any system I run because I have no need for printing and it bothers me to see it constantly during every system upgrade.
cups-browsed <= 2.0.1 binds on UDP INADDR_ANY:631 trusting any packet from any source
Well that would explain why I didn’t have it installed (although I did have other parts of cups until jwz coincidentally reminded us two days ago that it can all be removed if you don’t have a printer.) I clear out anything that opens ports I don’t need to be open. A practice I would recommend to anyone.
