The "9.9" Linux Vulnerability Revealed: It's The Printers

Summary

A severe 9.9 out of 10 remote code execution vulnerability in the Common Unix Printing System (CUPS) was discovered, allowing attackers to execute arbitrary code on Linux machines without authentication by sending a UDP packet to port 631. The researcher, Simon Margaritelli, published details prematurely due to information leaks. The flaw primarily impacts network printing and is present in many Linux distributions by default, prompting immediate security measures such as disabling CUPS or blocking port 631. The disclosure process was contentious, and the issue's widespread nature and complexity could significantly affect Linux printing support.

Takeaways

• 🐞 A critical vulnerability in the Common Unix Printing System (CUPS) allows remote code execution without authentication.
• 🔥 The severity of the vulnerability is rated 9.9 out of 10, indicating an extremely high risk.
• 🗣️ Researcher Simon Margaritelli discovered the flaw and initially planned to publish details on October 5th but released them earlier due to leaks.
• 🌐 The flaw affects a wide range of systems, including Linux, Chrome OS, and even some Apple systems.
• 🔍 The vulnerability is centered around the printing subsystem, specifically network printing features.
• 🚀 Attackers can execute arbitrary code on remote machines by sending a UDP packet to port 631.
• 🛠️ Remediation steps include disabling and removing the CUPS BrowseD service if not needed, updating the CUPS package, or blocking traffic to UDP Port 631.
• 📈 Margaritelli found hundreds of thousands of devices vulnerable by scanning the entire public IPv4 range.
• 📝 The response to the UDP packet can reveal detailed system information, including Linux distribution and kernel versions.
• 💡 The exploit leverages the CUPS Filter 2 directive to potentially execute malicious code when a print job is sent to a crafted printer queue.

Q & A

What is the severity rating of the remote code execution vulnerability discussed in the script?

The severity rating of the remote code execution vulnerability is 9.9 out of 10, indicating it is extremely serious.

Who discovered the remote code execution vulnerability and what is their role?

The vulnerability was discovered by Simon Margaritelli, who is a researcher and has published all the details about it.

What is the Common Unix Printing System (CUPS) and why is it significant in this context?

CUPS is a modular printing system for Unix-like computer operating systems that allows a computer to act as a print server. It is significant because the vulnerability revolves around CUPS, specifically affecting network printing.

How can an attacker exploit the CUPS vulnerability?

An attacker can exploit the CUPS vulnerability by sending a UDP packet to the remote machine on Port 631, which can lead to the execution of arbitrary code without authentication.

What are the CVE numbers associated with the vulnerabilities discussed in the script?

The script mentions that Simon Margaritelli has published the CVE numbers for the vulnerabilities, but they are not yet made public. However, they can be searched for once they become public.

Which systems are affected by the CUPS vulnerability?

The vulnerability affects a wide range of systems including most Linux distributions, some BSDs, Chrome OS, and possibly even Apple systems with variations of CUPS.

What is the recommended remediation for systems that are vulnerable to the CUPS exploit?

The recommended remediation includes disabling and removing the cups-browsed service if not needed, updating the CUPS package, and blocking all traffic to UDP Port 631.

What is a PPD file in the context of the CUPS system?

A PPD file is a text file provided by a vendor that describes the printer capabilities to CUPS in a domain-specific language and instructs it on how to use the printer properly.

How does the attacker use the PPD file in the exploitation process?

The attacker can send malicious attributes that are saved into a PPD file on the target's machine, which can then be executed when a print job is sent to the fake printer.

What is the potential impact of this vulnerability on Linux systems?

The potential impact is significant as it allows for remote code execution as root, which could lead to unauthorized access and control over affected Linux systems.

What does the researcher suggest about the state of security in Linux systems in general?

The researcher suggests that Linux systems are an endless and hopeless mess of security holes waiting to be exploited, indicating a systemic issue with security in complex systems.

Outlines

00:00

🔒 Remote Code Execution Vulnerability in CUPS

A severe remote code execution vulnerability, rated 9.9 out of 10, was discovered in the Common Unix Printing System (CUPS), which affects Linux systems without authentication. The researcher, Simon Margaritelli, published the details ahead of schedule due to information leaks. The vulnerability allows attackers to execute arbitrary code on remote machines by sending a UDP packet to port 631. The core issue revolves around the printing subsystem, and four specific vulnerabilities were identified in cups-browsed, lib cups filters, libpppd, and cs-filters. Popular Linux distributions like Ubuntu and Fedora have cups-browsed enabled by default, potentially exposing many systems to this threat.

05:00

🌐 Public Internet Attack Limitations and Remediation

The script discusses the limitations of the public internet attack, stating that it only affects servers directly connected to the internet. However, the presenter argues that this is a significant issue given the vast number of devices that could be affected. The researcher, Simon Margaritelli, has been scanning the entire public internet for vulnerable devices and found hundreds of thousands of affected systems. Remediation steps include disabling the cups-browseD service if not needed, updating the CUPS package, or blocking traffic to UDP Port 631. Margaritelli also suggests removing any CUPS service binaries and libraries from Unix systems to prevent exploitation.

10:01

🖨️ Exploiting the CUPS Vulnerability

The script details how the CUPS vulnerability can be exploited, with the researcher finding that the cups-browseD process runs as root and listens on UDP Port 631. By sending a UDP packet, an attacker can add a fake printer to a system without user notification. The script explains the role of PPD files in describing printer capabilities and how an attacker could use the CUPS Filter directive to execute remote code by injecting malicious PPD directives into a temporary file, waiting for a print job to trigger the malicious code.

15:03

📢 Fallout and Response to the CUPS Vulnerability Disclosure

The script describes the fallout from the disclosure of the CUPS vulnerability, including the researcher's frustration with the responsible disclosure process. Simon Margaritelli found that his findings were not taken seriously initially and had to engage in extensive communication with developers. The script also mentions that the vulnerability was rated 9.9 by engineers at Red Hat, indicating its severity. The researcher's experience with the disclosure process is highlighted, emphasizing the challenges faced by security researchers when dealing with vulnerability coordination.

20:06

🛠️ Mitigating the CUPS Vulnerability and Future Implications

The script concludes with recommendations for mitigating the CUPS vulnerability, such as disabling cups-browseD, uninstalling it if not needed, and blocking Port 631. It also discusses the widespread nature of the vulnerability and the potential for future issues with printing support on Linux due to the need to secure systems. The complexity of the CUPS system and the potential need for a complete re-architecture to address the vulnerability are highlighted, suggesting that fixing the issue fully will be a significant challenge.

Keywords

💡Remote Code Execution

Remote Code Execution (RCE) refers to the ability of an attacker to execute malicious code on a remote system without having physical access to it. In the context of the video, this is a critical vulnerability because it allows an attacker to send a UDP packet and execute arbitrary code on a remote Linux machine, which is a severe security risk. The video discusses this in the context of a 9.9 out of 10 vulnerability found in the Common Unix Printing System (CUPS).

💡Vulnerability

A vulnerability is a weakness in a system that can be exploited by an attacker. The video discusses a specific vulnerability in the CUPS system that allows for remote code execution. The severity of this vulnerability is underscored by its high rating of 9.9 out of 10, indicating a significant threat to system security.

💡CUPS (Common Unix Printing System)

CUPS is an open-source printing system that allows computer users to print documents and images to a variety of printers. In the video, it is highlighted as the core system affected by the vulnerability, which impacts not just Linux but also Chrome OS and potentially Apple systems. The vulnerability revolves around the network printing feature of CUPS.

💡UDP Packet

A UDP packet refers to a data packet used in networking protocols, specifically the User Datagram Protocol. In the video, the exploit revolves around sending a UDP packet to the remote machine's port 631, which triggers the execution of code. This method of exploitation is central to the discussed vulnerability.

💡CVE (Common Vulnerabilities and Exposures)

CVE is a system for identifying and cataloging publicly disclosed computer vulnerabilities. The video mentions that the researcher, Simon Margaritelli, has published CVE numbers for the issues found in CUPS but they are not yet public. CVEs are crucial for tracking and addressing security vulnerabilities.

💡Simon Margaritelli

Simon Margaritelli is the researcher who discovered the CUPS vulnerability and published details about it. His actions are significant because he chose to release the information sooner than planned due to leaks, which is a common practice to ensure that the public is aware of the vulnerability to protect themselves.

💡Mitigation

Mitigation in cybersecurity refers to the steps taken to reduce or eliminate the exploitability of a vulnerability. The video discusses several mitigation strategies for the CUPS vulnerability, such as disabling the cupsBrowseD service, updating the CUPS package, and blocking traffic to UDP Port 631.

💡Zeroconf (Zero Configuration Networking)

Zeroconf is a networking technology that enables devices to join a network without manual configuration of IP addresses, etc. The video mentions that on a local network, an attacker can spoof Zeroconf to exploit the CUPS vulnerability, demonstrating the attack's simplicity and the potential for widespread impact.

💡PPD (PostScript Printer Description)

PPD is a file format used to describe the capabilities of a printer to a printer driver. In the video, it is mentioned that an attacker could use the CUPS vulnerability to create a fake printer and inject malicious PPD directives, leading to remote code execution. This illustrates the depth of the exploit's potential impact.

💡Exploit

An exploit is a piece of software, a chunk of data, or a sequence of commands that takes advantage of a bug or vulnerability in order to cause unintended behavior in a system. The video discusses how the CUPS vulnerability can be exploited to execute arbitrary code on remote machines, which is a severe security concern.

💡Red Hat

Red Hat is a multinational software company engaged in providing open-source software products to the enterprise community. The video mentions that engineers at Red Hat rated the CUPS vulnerability as 9.9, indicating the severity of the issue from a reputable source in the industry.

Highlights

A 9.9 out of 10 remote code execution vulnerability was discovered in the Common Unix Printing System (CUPS).

The vulnerability allows unauthorized code execution on remote machines by sending a UDP packet.

Simon Margaritelli, the researcher who found the vulnerability, published the details ahead of schedule due to information leaks.

The core issue revolves around the printing subsystem, affecting systems that use CUPS for network printing.

CUPS is used on various platforms including Linux, Chrome OS, and even some Apple systems.

The researcher found four specific vulnerabilities in CUPS components: cups-browsed, libcupps, libppp, and cs-filters.

CVE numbers for the vulnerabilities have been published but are not yet public.

Many popular Linux distributions ship with cups-browsed enabled by default, increasing the attack surface.

An attacker on the public internet can exploit the vulnerability by sending a UDP packet to port 631.

On a local network, an attacker can spoof Zeroconf to achieve the same result.

The researcher recommends disabling and removing the cups-browsed service if not needed.

Updating the CUPS package or blocking all traffic to UDP port 631 are suggested remediation steps.

The researcher discovered that the response from a UDP packet can reveal the system's kernel version and architecture.

The exploit allows an attacker to add a fake printer to a victim's machine without user interaction.

A PPD file, used to describe printer capabilities, can be manipulated to include malicious directives.

The researcher successfully demonstrated remote code execution by creating a malicious PPD directive.

The disclosure process was criticized as being broken, with the researcher facing condescension and personal attacks.

The vulnerability was rated 9.9 by engineers at Red Hat, indicating its severity.

The researcher suggests completely removing CUPS from Unix systems due to the extensive codebase and potential for exploitation.

The leak of vulnerability details may have originated from within the vulnerability coordination environment at Carnegie Mellon.

The widespread nature of the vulnerability may lead to significant changes in how printing is supported on Linux systems.

Transcripts

the details of that 9.9 out of 10 remote

code execution vulnerability that we

found out about yesterday has been

revealed much sooner than anticipated

because there was a

link out of Vince uh going to get to all

of that in a minute but first let's talk

about exactly what this vulnerability is

high Lev yes it is a massive

vulnerability and it does allow people

to execute code on remote machines not

just Linux without authentication by

simply sending a sing a UDP packet by

sending a UDP packet to the remote

machine you can then execute code

arbitrary code this is very very much a

very bad thing I absolutely would rank

this a 9.9 out of 10 this is not good at

all uh the researcher that found this uh

Simon margaritelli uh has published all

of the details wasn't going to have this

this information published until October

I believe it is 5th but because it was

leaking out there

anyway it really it it was it was more

reasonable to get it out there I I agree

with with Simon margar tell's uh

reasoning for why he published this this

information now if it's already leaked

out and potential Bad actors have access

to this anyway why not get this

information widespread so that people

can at least mitigate against the

possible problems now the core of the

system here is entirely around the

printing subsystem it's around cups the

common Unix printing system baby that

almost every Linux machine has um I'm

going to read a couple of quotes here

from from Simon's post this is over at

evil socket.net which is his

website um Hello friends this is the

first of two possibly three if and when

I have the time to finish these W this

Windows research writeups we will start

with the with targeting gnu Linux

systems with a remote code execution

exploit as someone who's directly

involved in the cups project set and

again cups is responsible for printing

it's used on Linux systems it's used on

Chrome uh Chrome OS uh even even Apple

systems have variations on cups I don't

know if their specific versions are

impacted with this but they have them as

well quote from a generic security point

of view a whole Linux systems is as it

is now is just an endless and hopeless

mess of security holes waiting to be

exploited we all know this

extraordinarily complex and

interconnected systems breed an almost

endless number of of of possible uh

access points for for any sort of

exploit that's just that's just how it

is with the increasingly complex systems

um so the the specific vulnerabilities

that are being listed here today there

are four of them um uh issues in cups

browse d lib cups filters lib pppd and

cs- filters uh he's got the cve numbers

here published for all of them however

those cves are not yet made public but

you can grab them copy them and and

search for them and as soon as they get

made public additional uh information

will be available on them but again this

is all around the printing system

specifically as it relates to network

printing right Network printing which

means it impacts a lot of systems just

to give you an example here both auntu

and Fedora and many other extremely

popular Linux distributions ship with

cups browse D on and enabled by default

so when we're talking about uh Linux

desktop systems and honestly even most

Linux server systems you're going to be

wanting to check to see if you've got

that on by default uh it's just it's a

lot of systems so the entry points for

this particular attack the first is that

if you were on a the public internet

just on the Internet or on a wide area

network a remote attacker sends a UDP

packet to Port

631 no authentication whatsoever is

required on that that's an entry point

again a a UDP packet a UDP packet that

is Holy Heavens more details on how that

works or if you're on a local area

network a local T attacker can spoof

zero comp um um and achieve the same

code path leading to a remoto code

execution so it's incredibly simple uh

to to accomplish this um uh quoting one

of the first comments from the only guy

from the guy who literally wrote the

book about cups while trying to explain

to me why this is not why this is not

that bad this is crazy quote I am just

pointing out that the public internet

attack is limited to servers that are

directly connected to the

internet the picture that Simon margar

Deli uh included here was brilliant

because yeah again I'm going to repeat

that this is this is this is a reason

why this this attack is not that

bad the the public internet attack is

limited to servers that are directly

connected to the internet

that's like saying um the issue with the

cars driving on the road is only limited

to the cars driving on the road it's

like okay um let's go ahead and Rewind

and and reread that yourself um so he

lists here uh some affected systems um

so cups brows D are packaged for most

Unix system he says so most genu Linux

distribution yes that's true some bsds

also true chromium and Chrome OS also

true uh Solara

yes uh he says possibly more and and the

answer is yes to that uh this is going

to impact a lot of system systems uh he

goes on to say this thing is packaged

for anything and in some cases it's

enabled by default in others it's not go

figure it is more often than not enabled

by default it's not enabled by default

in every system and there are ways to

button down this which we'll get into as

we go along but on assume assume that

browse

uh cups browse D is enabled by default

on your system um so he checked this out

I've been scanning this is what he said

the entire public internet ipv4 ranges

several times a day for week sending the

UDP packet and logging whatever

connected back and I've gotten back

connections from hundreds of thousands

of devices with peaks of 200 to 300

concurrent devices this file he

published a file contains a list of the

unique Linux systems affected all the

different uh uh specific Linux version

numbers uh kernel numbers and whatnot

note that everything that is not Linux

has been filtered out uh and if you go

check out the file on his website it

literally is just a list of all Linux

version kernel

versions right it's just everything and

the reason he knows that is because the

response you get back by sending that

UDP packet actually tells you what kind

of what kind of system you're running so

you just send this UDP packet and you

get back the colel the colonel version

that you're you're you're pinging

basically it's crazy how much

information you can get um so

remediation so ways you can work around

this uh first uh disable and remove cups

browse D service if you don't need it

and probably you don't it's only

necessary if you're printing right and

if you've got a a network attached

printer update the cups package on your

systems and in case your system can't be

updated for some reason uh and for some

reason you rely on the c s some reason

you rely on the service block all

traffic to UDP Port 631 and possibly all

DNS SD traffic good luck if you use

zeroc comp okay he also says his

personal

recommendation I've seen and attacked

enough of this code base to remove any

cup service binary and library from any

of my systems and never again use a Unix

system to print oh man I'm also removing

every zero aahi bonjour listener you

might consider doing the same all right

I'm going to skip through I'm not going

to greet his whole story here but I want

to point out a couple of things that he

found along the way so you understand

exactly how much power this particular

remote code execution exploit can have

so he noticed this cups brows D was

running he noticed that that process C

was running as root and listening to you

on UDP Port

631 uh he says that uh after some

Googling I found out that cups browse D

is indeed part of the cups system and is

responsible for discovering new printers

and automatically adding them to the

system right so that's what CBS CBS

browse D does all right let's just jump

jump ahead a little bit because he goes

through the technical details if you

want those technical details go grab it

if all checks pass so if you you you uh

you know you send in that udb packet and

you start communication if all checks

pass which they're probably going to two

text fields parsed from the packet are

passed to the found cups printer

function right then it goes through a

series of of various functions as it as

it goes along and then we get to here um

uh both of these issues uh so and he

gets through a number of issues that he

hits uh issues have been reported and

thoroughly documented to the devs and

the cert but nobody seems to give a damn

I can tell you that there there are

other more easily exploitable code paths

going on not just the the functions he

outlines not just in the discovery

mechanism also reported and ignored to

this day they have not been acknowledged

rep patched happy

hunting

so um he the Simon margari uh

margaritelli he definitely has some

strong feelings about how this is has

been handled right out of the bat um he

feels like this hasn't been taken

seriously enough and looking at things

initially not seeing some of the sort of

secret Communications that have happened

and have not been opened up it does seem

like yeah maybe this hasn't been taken

as seriously as it should uh he

continues quote so I tell myself there's

no freaking way that if I send this

packet to a public IP address running

cups that computer will connect back to

the server I specified no way and he you

know holy beep not only it connected

back immediately but it also reported

the exact kernel version and

architecture in the user agent header uh

it also reports the requesting username

on the target for some of the requests

that you can send in again via plain old

UDP baby um he says I went back to

writing some code and by using the IP

server python package I was now able to

respond properly with attributes I

controlled to the service request my

fake printer was immediately added to

the local printers with no notification

whatsoever to the user then he posted a

screenshot of him um post of creating a

new printer uh called God God God God

God in the with the location of In Your

Butt um which is clearly a real

printer and that's very very crazy right

that you can do that without any

authentication from the end user then

user doesn't get to choose it you just

send some packets at a machine

unauthenticated and you can add printers

to that machine and he goes on to say it

looks like the service fetches these

attributes uh when it it creates some

sort of temporary file uh with the

attributes he was pointing out uh that

were that were created uh a PPD file on

which these attributes are possibly

saved so he's like okay so I can send

some attributes for a printer it's it's

added into a PPD file that's saved loow

Al on the user's machine all right so

what is exactly is a PPD file well this

is commonly not known I used to work at

hulet Packard like in the 90s I worked

at huet Packard and and I I'm pretty

intimately aware with this but he writes

a pretty decent description of exactly

what a PPD is a PPD file is a text file

provided by a vendor that describes a

domain specific in a domain specific

language the printer capabilities to

cups and instructs it on how to use it

properly it's it's basically a here's

this printer here's the details about it

here's how you use it it's a real simple

file that way

right um I spent a few hours just

reading the PPD specs and studying cup

specific extensions in order to find

something I could rely I could I could

really try to perform an attack and then

I found out about cups Filter 2

directive okay here's where the remote

code execution from all this comes in

because up until now you're just sending

UDP packets and being annoying because

you're creating a printer that's fake on

someone's machine that's annoying but

that's not 9.9 severity right here's

where it gets gnarly a filter is any

executable contained in the user lib

cups filter path um which will get

executed when a print job is sent to the

printer and I think several of you are

going uhoh I I see where this is going

uh now it uses something called

fumatic um and quote they have to ow

fumatic the command line program to

accept pretty much anything including

Pearl or many printers will stop working

on Unix basically there's this this old

chunk of code that's there to handle um

called fumatic all of these different

printing scenarios and different types

of printer Hardware especially older

printers newer ones not quite as often

and you have to basically allow it to to

execute darn near anything in order for

it to happen so in theory be using that

we should now be able to this was him

theorizing about what he could do before

he tested it Force the target machine to

connect back to our malicious IP server

return an IP attribute string that will

inject controlled PPD directives to the

temporary file basically send some udb

packets make a connection send some

attributes just some some custom created

malicious attributes that will be

created into a PPD text file on the on

the target's machine and wait for a

print job to be sent to that fake

printer for the PPD directives and

therefore run the command right kicks

off the command and you can kick off

that printer the same way so let's so

let's let's see how this plays out uh

and uh well it worked it worked he tried

it it worked he provided the details

here on how you can do it so if any

viewer looking to do it wouldn't take

too much work to create the the empty

things that he didn't mention in here um

uh he says uh uh one additional thing he

included here and this is about how this

is all played out since he revealed this

to to uh uh the printing group right so

are the printer developers while the

research only took a couple of days this

part talking with the developers of of

the projects took 22 and this part was

not fun I will only say that to my

personal experience the responsible

disclosure process is broken that a lot

is expected and taken for granted from

the security researchers by triers that

believe like you have to prove to be

worth listening to while in reality they

barely care to process and understand

what you are saying only to realize you

were right all along 3 weeks later if at

all 2 days for the research 249 lines of

text for the fully working exploit 22

days of arguments condescension several

gaslighting attempts uh more or less

subtle personal attacks dozens of emails

and messages more than 100 pages of text

in total hours and hours and hours and

woo lots of swear words there he's

feeling salty about it is what I'm

saying um and the the 9.9

rating uh he goes on to to show some

screenshots how the 9.9 rating was

actually given by engineers at Red Hat

uh who uh who rated it as such and I'm

going to be honest this is pretty I

agree that this is this should have a

very high rating I I don't care if you

call it a 10 I don't care if you call it

a nine a 9 point something whatever this

is not like some middle of the road 5

point something exploit uh you have the

ability to remote code execute as root

because that's what cups brows D run as

it runs as root you have the ability to

run as root AR code

execution to any

system mostly via just some simple UDP

it's it's uh it's too trivial it's it's

too trivial and it's too widespread now

there's a lot of machines that don't

currently have cups browse de enabled by

default and that's probably good um if

you haven't blocked uh let's go back up

here a little ways about what you can do

to block this if you have not blocked

was it Port uh 623 3 632 I'm going to go

look it up for you real quick um Port

631 Port 631 block it uh block it now uh

because it's uh yeah yeah yeah yeah this

is too easy to exploit and now that this

is out in the wild which um this uh

Simone margaritelli he's not really the

one that put it out in the wild it was

leaked out there now here's where here's

where things get a little weird this was

leaked

over on uh breach forums. St I'm not

going to show it here but if you go log

into there you can you can get into it

and it looks like because of the

information that was

leaked it was specifically information

that Simone margaritelli had given to

Vince now what is Vince Vince is the

vulnerability information and

coordination environment um over at

Carnegie melan at C and um that means

and they're really the ones who handle

all of this stuff right all right all of

all of this all of the um hold on let me

scroll down here so you can see here all

the CV cves and whatnot you'll go find

those over with with certain Vince and

um there was a leak within Vince so

someone at

Vince if Simone margaritelli is to be be

believed which so far he's proven

he's followed through I mean he's

claimed everything he claimed previously

has proven to be true um then then Vince

does have a leak the other possibility

is that Simone marar telli is the leak

those are the those are kind of the two

obvious options or someone else was

given

this that we're not hearing about but

either way there clearly was a a leak in

all of this that is worth looking into

um so once this was already leaked out

there it's good that we now have the

details around it and we know to disable

cups you know get rid of of Cups d uh

cups browse D disable it completely

uninstall it from your system if you

don't use printers uh block Port 6 uh

631 um just all sorts of things that you

can do to mediate against this potential

attack however as as Simon margaritelli

pointed out um this is pretty widespread

I mean having cups brows D enabled by

Def fault on an open port is incredibly

common he found hundreds of thousands of

examples and I have no reason to doubt

that just simply knowing how these

printers work and knowing how networking

works and knowing these distributions as

intimately as I do I can I can say yeah

auntu Has It by default Fedora Has It by

default so many distributions have Cubs

browse on by default for convenience you

want to make printers work well out of

the box for end users otherwise they're

going to start

complaining so oh it's on by default I

mean that's how you discover and add

printers it's like oh there's a network

printer on your thing here it's added

for you so you can now print with it

right so there you go um so is this a

9.9 I would I would say so you're

probably over the coming days going to

hear a lot of argument about the the

severity ratings of this one about um

whether or not certain dros are

vulnerable at all um how overblown it

might have been or

under discussed it might have been I

think you're going to hear a lot of

yelling from both sides on that but

regardless this is a pretty major issue

and uh it's going to be difficult to fix

this issue fully uh and and the reasons

for that are the the ability to do the

code execution with inside of the cup

system is a critical component of of

using a hundreds and hundreds of models

of printers and so in order to fix this

fully that needs to be patched and

that's going to break the the Linux

compatibility with a lot of printers

unless a new system is is put in place

and new ways of working with those uh

those driver those printers is is

developed which is going to just be an

absolute massive amount of work I mean

considering this code has been around

for decades now and is a giant spider

web it is not uh an easy codebase to

understand the individual uh printer

drivers such as they are are a funky

mismatch of executable files uh uh Pearl

scripts all sorts of things in order to

uh format files correctly when they're

sent to the printer so fixing them for

all of these printers is going to be a a

mild Nightmare and I'm I'm sure

that the cups and uh the open printing

developers and whatnot have been

hesitant to do that because it is a

nightmare it's not a it's not a mild

thing it's a complete re architecture in

some ways of how a lot of these systems

work um so going forward in the very

near future my guess is we're going to

see printing support on Linux hindered

significantly in the name of securing

our systems I mean that seems like the

the reasonable way to go we can't leave

all these vulnerabilities in place and

and we can't simply expect that everyone

on a device is going to be behind a

firewall blocking Port 631 I

I there there it's a good temporary

measure but uh but really this needs to

be tackled with inside cups so there you

go there you have it uh there's all the

details again you can read all the

details posted over at evil socket which

is a great domain. net uh so thank you

to Simon margaritelli for posting all of

that uh and uh letting us

know what to do to lock our systems down

and with that ladies and gentlemen boys

and girls nerds and nerds across the

inner tubes I do declare and broadcast