Attacking Unix Systems via Cups, Part I

Re:Attacking Unix Systems via Cups, Part I by RGBCube on Thursday September 26, 2024 @04:07PM (#41662689)

I also cannot believe that this is the 9.9 rated CVE. For comparison, heartbleed was a 7.5. I was awaiting a Total Linux Meltdown at best and a collapse of the world economy at worst with the amount of hyping up and fearmongering that the author did on social media.

[ Parent | on HN ]

Re:Attacking Unix Systems via Cups, Part I by bogantech on Thursday September 26, 2024 @04:12PM (#41662753)

Link to the OP for those that haven't seen it: https://x.com/evilsocket/status/1838169889330135132

Hyped it up to be some massive thing but it turned out to be a massive nothingbuger for me at least

[ Parent | on HN ]

Re:Attacking Unix Systems via Cups, Part I by RGBCube on Thursday September 26, 2024 @04:15PM (#41662804)

Non-loginwalled link: https://threadreaderapp.com/thread/1838169889330135132.html

[ Parent | on HN ]

Re:Attacking Unix Systems via Cups, Part I by maeln on Thursday September 26, 2024 @04:28PM (#41662958)

It's always funny to me how cybersecurity always seem to attract people with a ... certain sense of ego.

[ Parent | on HN ]

Re:Attacking Unix Systems via Cups, Part I by ChocolateGod on Thursday September 26, 2024 @05:55PM (#41663916)

> pretty much only got patronized because the devs just can't accept that their code is crap - responsible disclosure: no more.

I can think of another reason they got patronised.

[ Parent | on HN ]

Re:Attacking Unix Systems via Cups, Part I by evilos on Friday September 27, 2024 @12:57AM (#41666402)

They claim to not be a cybersecurity pro

[ Parent | on HN ]

Re:Attacking Unix Systems via Cups, Part I by NavinF on Thursday September 26, 2024 @04:14PM (#41662789)

Yeah tbh it's not as bad as he claimed. I doubt this is actually rated 9.9:

>A remote unauthenticated attacker can silently replace existing printers’ (or install new ones) IPP urls with a malicious one, resulting in arbitrary command execution (on the computer) when a print job is started (from that computer).

>WAN / public internet: a remote attacker sends an UDP packet to port 631. No authentication whatsoever.

>LAN: a local attacker can spoof zeroconf / mDNS / DNS-SD advertisements (we will talk more about this in the next writeup ) and achieve the same code path leading to RCE.

Still, sucks for linux desktop users. Looks like any random device on your wifi/vpn can screw you over

[ Parent | on HN ]

Re:Attacking Unix Systems via Cups, Part I by floren on Thursday September 26, 2024 @04:16PM (#41662808)

Or any malicious user on the airport wifi. The compromise will linger until however many weeks later when you decide to print something...

[ Parent | on HN ]

Re:Attacking Unix Systems via Cups, Part I by bremac on Thursday September 26, 2024 @04:35PM (#41663050)

Keep in mind that you still need send a print job to the fake printer to trigger the exploit. If you send the job to your real printer, nothing happens.

[ Parent | on HN ]

Re:Attacking Unix Systems via Cups, Part I by crote on Thursday September 26, 2024 @10:30PM (#41665702)

The exploit allows an attacker to overwrite your real printer with their fake printer.

[ Parent | on HN ]

Re:Attacking Unix Systems via Cups, Part I by graemep on Friday September 27, 2024 @05:55AM (#41668275)

Not using the "WAN" attack if you are using a firewall config that stops that on public wifi.

I do not understand how the mDNS entry point works.

[ Parent | on HN ]

Re:Attacking Unix Systems via Cups, Part I by rolph on Thursday September 26, 2024 @04:18PM (#41662839)

i knew there was a reason i blacklist unsolicited/unauthenticated UDP inbound.

[ Parent | on HN ]