Reflecting on the CUPS CVEs

[@hexdump1337]

it is important to realize that while the chain described within the article can be described as "RCE through printing". This means, when a printing event is initiated on the malicious printer, the malicious command is executed. The question on whether this requires user interaction or not depends mainly on the environment under analysis. If the environment has no extra configuration, then it does require user interaction. If however the environment has other services that allow to print by sending specific requests to specific ports, then there are ways to achieve RCE even without user interaction. This is to say that it's hard to describe all the possible risk scenarios without understanding every single possible environment, and also what are the most probably environments in, for example, home LANs or in corporate LANs and so forth. Ultimately, the takeway is: disable CUPS if you do not need to print stuff, and if you need to print stuff, be careful on how your instance is configured, and do not accept connection from arbitrary IPs.

[@ДмитрийКузнецов-я4д]

The best explanations about this CVE i ve seen , thanks a million

[@behindYOUR6]

Thanks for talking about this

[@pradeepkumarsharma8789]

Thanks a lot

[@pohjoisenvanhus]

Hunting for vulnerabilities is somewhat of a business nowadays so it just makes sense for people for whom money and fame is an incentive to exaggerate the issues, isn't it? But as someone who's a bit new to reading CVSS scores I'm a tiny bit surprised that RedHat's portal doesn't include a breakdown of the score that would include the reasoning behind the component scores.

[@hexdump1337]

In security it actually happens many times, definitely more times than it should, to not include much information behind CVEs or CVSS scores like these. Indeed, both CVEs and CVSS can be extremely useful but also extremely useless, depending on how they are used. I’ll come back to these themes in the channel for sure. With respect to the “exaggeration” part, I’d say it’s a very interesting and potentially useful attack vector in red teaming scenarios involving corporate networks. People probably would not have picked this up if it weren’t for the “hype”.