The "9.9" Linux Vulnerability Revealed: It's The Printers

Summary

A severe 9.9 out of 10 remote code execution vulnerability in the Common Unix Printing System (CUPS) was discovered, allowing attackers to execute arbitrary code on Linux machines without authentication by sending a UDP packet to port 631. The researcher, Simon Margaritelli, published details prematurely due to information leaks. The flaw primarily impacts network printing and is present in many Linux distributions by default, prompting immediate security measures such as disabling CUPS or blocking port 631. The disclosure process was contentious, and the issue's widespread nature and complexity could significantly affect Linux printing support.

Takeaways

• 🐞 A critical vulnerability in the Common Unix Printing System (CUPS) allows remote code execution without authentication.
• 🔥 The severity of the vulnerability is rated 9.9 out of 10, indicating an extremely high risk.
• 🗣️ Researcher Simon Margaritelli discovered the flaw and initially planned to publish details on October 5th but released them earlier due to leaks.
• 🌐 The flaw affects a wide range of systems, including Linux, Chrome OS, and even some Apple systems.
• 🔍 The vulnerability is centered around the printing subsystem, specifically network printing features.
• 🚀 Attackers can execute arbitrary code on remote machines by sending a UDP packet to port 631.
• 🛠️ Remediation steps include disabling and removing the CUPS BrowseD service if not needed, updating the CUPS package, or blocking traffic to UDP Port 631.
• 📈 Margaritelli found hundreds of thousands of devices vulnerable by scanning the entire public IPv4 range.
• 📝 The response to the UDP packet can reveal detailed system information, including Linux distribution and kernel versions.
• 💡 The exploit leverages the CUPS Filter 2 directive to potentially execute malicious code when a print job is sent to a crafted printer queue.

Q & A

What is the severity rating of the remote code execution vulnerability discussed in the script?

The severity rating of the remote code execution vulnerability is 9.9 out of 10, indicating it is extremely serious.

Who discovered the remote code execution vulnerability and what is their role?

The vulnerability was discovered by Simon Margaritelli, who is a researcher and has published all the details about it.

What is the Common Unix Printing System (CUPS) and why is it significant in this context?

CUPS is a modular printing system for Unix-like computer operating systems that allows a computer to act as a print server. It is significant because the vulnerability revolves around CUPS, specifically affecting network printing.

How can an attacker exploit the CUPS vulnerability?

An attacker can exploit the CUPS vulnerability by sending a UDP packet to the remote machine on Port 631, which can lead to the execution of arbitrary code without authentication.

What are the CVE numbers associated with the vulnerabilities discussed in the script?

The script mentions that Simon Margaritelli has published the CVE numbers for the vulnerabilities, but they are not yet made public. However, they can be searched for once they become public.

Which systems are affected by the CUPS vulnerability?

The vulnerability affects a wide range of systems including most Linux distributions, some BSDs, Chrome OS, and possibly even Apple systems with variations of CUPS.

What is the recommended remediation for systems that are vulnerable to the CUPS exploit?

The recommended remediation includes disabling and removing the cups-browsed service if not needed, updating the CUPS package, and blocking all traffic to UDP Port 631.

What is a PPD file in the context of the CUPS system?

A PPD file is a text file provided by a vendor that describes the printer capabilities to CUPS in a domain-specific language and instructs it on how to use the printer properly.

How does the attacker use the PPD file in the exploitation process?

The attacker can send malicious attributes that are saved into a PPD file on the target's machine, which can then be executed when a print job is sent to the fake printer.

What is the potential impact of this vulnerability on Linux systems?

The potential impact is significant as it allows for remote code execution as root, which could lead to unauthorized access and control over affected Linux systems.

What does the researcher suggest about the state of security in Linux systems in general?

The researcher suggests that Linux systems are an endless and hopeless mess of security holes waiting to be exploited, indicating a systemic issue with security in complex systems.