News for hackers. Stuff that matters.

A comment on Attacking Unix Systems via Cups, Part I. Parent comment

Re:Attacking Unix Systems via Cups, Part I by mikepavone on Thursday September 26, 2024 @04:33PM (#41663024)
On my Ubuntu 22.04 machine, cupsd itself is only listening on localhost, but cups-browsed (which is what has the vulnerability here) is listening on 0.0.0.0
[ Parent | on HN ]
Re:Attacking Unix Systems via Cups, Part I by raverbashing on Thursday September 26, 2024 @04:36PM (#41663056)
Why does it even listens in UDP at this day and age?!
[ Parent | on HN ]
Re:Attacking Unix Systems via Cups, Part I by mikepavone on Thursday September 26, 2024 @04:47PM (#41663175)
I believe it's implementing DNS-SD for network printer auto-discovery. I'm not terribly familiar with DNS-SD, but given that normal DNS is UDP based it would be unsurprising for DNS-SD to also use UDP.
[ Parent | on HN ]
Re:Attacking Unix Systems via Cups, Part I by ahoka on Thursday September 26, 2024 @06:16PM (#41664110)
DNS is actually UDP/TCP. It’s probably required for receiving unicast messages, if it’s using DNS-SD
[ Parent | on HN ]
Re:Attacking Unix Systems via Cups, Part I by ahoka on Thursday September 26, 2024 @06:14PM (#41664090)
To receive multicast messages, probably.
[ Parent | on HN ]
Re:Attacking Unix Systems via Cups, Part I by yrro on Friday September 27, 2024 @11:46AM (#41671955)
The purpose of cups-browsed is to listen on a UDP port which allows it to receive broadcasts from legacy cups servers on the local network, whereupon it will talk to cups and configure a local print queue for the printers on the discovered server.

A modern setup doesn't need it and doesn't use it.

[ Parent | on HN ]