Re:Attacking Unix Systems via Cups, Part I
by floren on Thursday September 26, 2024 @04:16PM
(#41662808)
Or any malicious user on the airport wifi. The compromise will linger until however many weeks later when you decide to print something...
Re:Attacking Unix Systems via Cups, Part I
by bremac on Thursday September 26, 2024 @04:35PM
(#41663050)
Keep in mind that you still need send a print job to the fake printer to trigger the exploit. If you send the job to your real printer, nothing happens.
Re:Attacking Unix Systems via Cups, Part I
by crote on Thursday September 26, 2024 @10:30PM
(#41665702)
The exploit allows an attacker to overwrite your real printer with their fake printer.
>A remote unauthenticated attacker can silently replace existing printers’ (or install new ones) IPP urls with a malicious one, resulting in arbitrary command execution (on the computer) when a print job is started (from that computer).
>WAN / public internet: a remote attacker sends an UDP packet to port 631. No authentication whatsoever.
>LAN: a local attacker can spoof zeroconf / mDNS / DNS-SD advertisements (we will talk more about this in the next writeup ) and achieve the same code path leading to RCE.
Still, sucks for linux desktop users. Looks like any random device on your wifi/vpn can screw you over