Exploit

CVE-2024-47076

Improper Input Validation (CWE-20)

Published: Sep 26, 2024 / Updated: 54d ago

Oracle Id: linuxbulletinoct2024 Release Date: 2024-10-15 Update Date: 2024-10-15 Description The Oracle Linux Bulletin lists all CVEs that had been resolved and announced in Oracle Linux Security Advisories (ELSA) in the last one month prior to the release of the bulletin. Oracle Linux Bulletins are published on the same day as Oracle Critical Patch Updates are released. These bulletins will also be updated for the following two months after their release (i.e., the two months between the normal quarterly Critical Patch Update publication dates) to cover all CVEs that had been resolved in those two months following the bulletin's publication. In addition, Oracle Linux Bulletins may also be updated for vulnerability issues deemed too critical to wait for the next scheduled bulletin publication date. Due to the threat posed by a successful attack, Oracle strongly recommends that customers apply Oracle Linux Bulletin security patches as soon as possible. Oracle Linux Risk Matrix (Revision: 1 Published on 2024-10-15) CVE-2024-3596 CVSS Base Score :9.0 CVSS Vector :CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H Product :

CUPS is a standards-based, open-source printing system, and `libcupsfilters` contains the code of the filters of the former `cups-filters` package as library functions to be used for the data format conversion tasks needed in Printer Applications. CUPS is a standards-based, open-source printing system, and `cups-browsed` contains network printing functionality including, but not limited to, auto-discovering print services and shared printers.

Name CVE-2024-47076 Description CUPS is a standards-based, open-source printing system, and `libcupsfilters` contains the code of the filters of the former `cups-filters` package as library functions to be used for the data format conversion tasks needed in Printer Applications. The `cfGetPrinterAttributes5` function in `libcupsfilters` does not sanitize IPP attributes returned from an IPP server. When these IPP attributes are used, for instance, to generate a PPD file, this can lead to attacker controlled data to be provided to the rest of the CUPS system. Source CVE (at NVD ; CERT , LWN , oss-sec , fulldisc , Red Hat , Ubuntu , Gentoo , SUSE bugzilla / CVE , GitHub advisories / code / issues , web search , more ) References DLA-3905-1 , DSA-5778-1 Debian Bugs 1082821 , 1082827 Vulnerable and fixed packages The table below lists information on source packages. Source Package Release Version Status cups-filters ( PTS ) bullseye 1.28.7-1+deb11u2 vulnerable bullseye (security) 1.28.7-1+deb11u3 fixed bookworm 1.28.17-3 vulnerable bookworm (security) 1.28.17-3+deb12u1 fixed trixie 1.28.17-4.1 vulnerable sid 1.28.17-5 fixed libcupsfilters ( PTS ) sid, trixie 2.0.0-3 fixed The information below is based on the following data on fixed versions. Notes https://github.com/OpenPrinting/libcupsfilters/security/advisories/GHSA-w63j-6g73-wmg5 https://www.evilsocket.net/2024/09/26/Attacking-UNIX-systems-via-CUPS-Part-I/ Fixed by: https://github.com/OpenPrinting/libcupsfilters/commit/95576ec3d20c109332d14672a807353cdc551018

These vulnerabilities are unlikely to be exploited in most cloud environments due to their requirements for exposing UDP port 631 and needing the victim to attempt a print request as part of the currently disclosed exploitation method. While no successful exploitation has been reported in the wild as of today, September 29, 2024, Wiz Threat Research has observed the following IPs attempting UDP communication through port 631, most likely scanning this port for malicious purposes or as part of security research -

Prisma Cloud Compute Cortex XDR Agent 8.6

Within the day, customers could test whether they were vulnerable thanks to the rollout of a new scanning engine framework that reinvents how Detectify operates under the hood, allowing for a faster and more efficient response to security threats. As soon as the CUPS flaw was detected, Detectify entered war-room mode to build a test for the vulnerability and ensure that customers were kept safe against such a critical threat.

Oracle Linux has issued many security upgrades, including squid, binutils, evolution, webkit2gtk3,.NET 6.0, and cups-filters. They also solve vulnerabilities with the cups-filters and giflib security features in Oracle Linux 7.

Vendor IBM Corporation A remote unauthenticated attacker can use a specially crafted PPD file and execute arbitrary commands on the target system.

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet. The vulnerability allows a remote attacker to execute arbitrary commands on the target system.