cve-2024-47176
Vulnerability from cvelistv5
Published
2024-09-26 21:13
Modified
2024-10-02 19:16
Severity ?
5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Summary
CUPS is a standards-based, open-source printing system, and `cups-browsed` contains network printing functionality including, but not limited to, auto-discovering print services and shared printers. `cups-browsed` binds to `INADDR_ANY:631`, causing it to trust any packet from any source, and can cause the `Get-Printer-Attributes` IPP request to an attacker controlled URL. When combined with other vulnerabilities, such as CVE-2024-47076, CVE-2024-47175, and CVE-2024-47177, an attacker can execute arbitrary commands remotely on the target machine without authentication when a malicious printer is printed to.
References
security-advisories@github.comhttps://github.com/OpenPrinting/cups-browsed/blob/master/daemon/cups-browsed.c#L13992
security-advisories@github.comhttps://github.com/OpenPrinting/cups-browsed/security/advisories/GHSA-rj88-6mr5-rcw8
security-advisories@github.comhttps://github.com/OpenPrinting/cups-filters/security/advisories/GHSA-p9rh-jxmq-gq47
security-advisories@github.comhttps://github.com/OpenPrinting/libcupsfilters/security/advisories/GHSA-w63j-6g73-wmg5
security-advisories@github.comhttps://github.com/OpenPrinting/libppd/security/advisories/GHSA-7xfx-47qg-grp6
security-advisories@github.comhttps://www.cups.org
security-advisories@github.comhttps://www.evilsocket.net/2024/09/26/Attacking-UNIX-systems-via-CUPS-Part-I
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2024/09/27/6
af854a3a-2127-422b-91ae-364da2661108https://github.com/OpenPrinting/cups-browsed/commit/1debe6b140c37e0aa928559add4abcc95ce54aa2
Impacted products
Vendor Product Version
OpenPrinting cups-browsed Version: <= 2.0.1
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-09-27T19:39:10.340Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  url: "http://www.openwall.com/lists/oss-security/2024/09/27/6",
               },
               {
                  url: "https://github.com/OpenPrinting/cups-browsed/commit/1debe6b140c37e0aa928559add4abcc95ce54aa2",
               },
            ],
            title: "CVE Program Container",
            x_generator: {
               engine: "ADPogram 0.0.1",
            },
         },
         {
            affected: [
               {
                  cpes: [
                     "cpe:2.3:a:openprinting:cups:*:*:*:*:*:*:*:*",
                  ],
                  defaultStatus: "unknown",
                  product: "cups",
                  vendor: "openprinting",
                  versions: [
                     {
                        status: "affected",
                        version: "2.0.1",
                     },
                  ],
               },
            ],
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2024-47176",
                        options: [
                           {
                              Exploitation: "poc",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-09-27T18:10:15.456578Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-09-27T18:13:04.491Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "cups-browsed",
               vendor: "OpenPrinting",
               versions: [
                  {
                     status: "affected",
                     version: "<= 2.0.1",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "CUPS is a standards-based, open-source printing system, and `cups-browsed` contains network printing functionality including, but not limited to, auto-discovering print services and shared printers. `cups-browsed` binds to `INADDR_ANY:631`, causing it to trust any packet from any source, and can cause the `Get-Printer-Attributes` IPP request to an attacker controlled URL. When combined with other vulnerabilities, such as CVE-2024-47076, CVE-2024-47175, and CVE-2024-47177, an attacker can execute arbitrary commands remotely on the target machine without authentication when a malicious printer is printed to.",
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 5.3,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "NONE",
                  integrityImpact: "LOW",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
                  version: "3.1",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-1327",
                     description: "CWE-1327: Binding to an Unrestricted IP Address",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2024-10-02T19:16:51.368Z",
            orgId: "a0819718-46f1-4df5-94e2-005712e83aaa",
            shortName: "GitHub_M",
         },
         references: [
            {
               name: "https://github.com/OpenPrinting/cups-browsed/security/advisories/GHSA-rj88-6mr5-rcw8",
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://github.com/OpenPrinting/cups-browsed/security/advisories/GHSA-rj88-6mr5-rcw8",
            },
            {
               name: "https://github.com/OpenPrinting/cups-filters/security/advisories/GHSA-p9rh-jxmq-gq47",
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://github.com/OpenPrinting/cups-filters/security/advisories/GHSA-p9rh-jxmq-gq47",
            },
            {
               name: "https://github.com/OpenPrinting/libcupsfilters/security/advisories/GHSA-w63j-6g73-wmg5",
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://github.com/OpenPrinting/libcupsfilters/security/advisories/GHSA-w63j-6g73-wmg5",
            },
            {
               name: "https://github.com/OpenPrinting/libppd/security/advisories/GHSA-7xfx-47qg-grp6",
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://github.com/OpenPrinting/libppd/security/advisories/GHSA-7xfx-47qg-grp6",
            },
            {
               name: "https://github.com/OpenPrinting/cups-browsed/blob/master/daemon/cups-browsed.c#L13992",
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://github.com/OpenPrinting/cups-browsed/blob/master/daemon/cups-browsed.c#L13992",
            },
            {
               name: "https://www.cups.org",
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.cups.org",
            },
            {
               name: "https://www.evilsocket.net/2024/09/26/Attacking-UNIX-systems-via-CUPS-Part-I",
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.evilsocket.net/2024/09/26/Attacking-UNIX-systems-via-CUPS-Part-I",
            },
         ],
         source: {
            advisory: "GHSA-rj88-6mr5-rcw8",
            discovery: "UNKNOWN",
         },
         title: "cups-browsed binds to `INADDR_ANY:631`, trusting any packet from any source",
      },
   },
   cveMetadata: {
      assignerOrgId: "a0819718-46f1-4df5-94e2-005712e83aaa",
      assignerShortName: "GitHub_M",
      cveId: "CVE-2024-47176",
      datePublished: "2024-09-26T21:13:05.913Z",
      dateReserved: "2024-09-19T22:32:11.962Z",
      dateUpdated: "2024-10-02T19:16:51.368Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
   "vulnerability-lookup:meta": {
      nvd: "{\"cve\":{\"id\":\"CVE-2024-47176\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2024-09-26T22:15:04.497\",\"lastModified\":\"2024-11-21T09:39:28.853\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"CUPS is a standards-based, open-source printing system, and `cups-browsed` contains network printing functionality including, but not limited to, auto-discovering print services and shared printers. `cups-browsed` binds to `INADDR_ANY:631`, causing it to trust any packet from any source, and can cause the `Get-Printer-Attributes` IPP request to an attacker controlled URL. When combined with other vulnerabilities, such as CVE-2024-47076, CVE-2024-47175, and CVE-2024-47177, an attacker can execute arbitrary commands remotely on the target machine without authentication when a malicious printer is printed to.\"},{\"lang\":\"es\",\"value\":\"CUPS es un sistema de impresión de código abierto basado en estándares, y `cups-browsed` contiene funcionalidades de impresión en red que incluyen, entre otras, servicios de impresión de detección automática e impresoras compartidas. `cups-browsed` se vincula a `INADDR_ANY:631`, lo que hace que confíe en cualquier paquete de cualquier origen, y puede provocar la solicitud IPP `Get-Printer-Attributes` a una URL controlada por el atacante. Debido a la vinculación del servicio a `*:631 ( INADDR_ANY )`, se pueden explotar varios errores en `cups-browsed` en secuencia para introducir una impresora maliciosa en el sistema. Esta cadena de exploits finalmente permite a un atacante ejecutar comandos arbitrarios de forma remota en la máquina de destino sin autenticación cuando se inicia un trabajo de impresión. Esto plantea un riesgo de seguridad significativo en la red. Cabe destacar que esta vulnerabilidad es particularmente preocupante ya que se puede explotar desde Internet público, lo que potencialmente expone una gran cantidad de sistemas a ataques remotos si sus servicios CUPS están habilitados.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N\",\"baseScore\":5.3,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":1.4}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-1327\"}]}],\"references\":[{\"url\":\"https://github.com/OpenPrinting/cups-browsed/blob/master/daemon/cups-browsed.c#L13992\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/OpenPrinting/cups-browsed/security/advisories/GHSA-rj88-6mr5-rcw8\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/OpenPrinting/cups-filters/security/advisories/GHSA-p9rh-jxmq-gq47\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/OpenPrinting/libcupsfilters/security/advisories/GHSA-w63j-6g73-wmg5\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/OpenPrinting/libppd/security/advisories/GHSA-7xfx-47qg-grp6\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://www.cups.org\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://www.evilsocket.net/2024/09/26/Attacking-UNIX-systems-via-CUPS-Part-I\",\"source\":\"security-advisories@github.com\"},{\"url\":\"http://www.openwall.com/lists/oss-security/2024/09/27/6\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://github.com/OpenPrinting/cups-browsed/commit/1debe6b140c37e0aa928559add4abcc95ce54aa2\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
      vulnrichment: {
         containers: "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"http://www.openwall.com/lists/oss-security/2024/09/27/6\"}, {\"url\": \"https://github.com/OpenPrinting/cups-browsed/commit/1debe6b140c37e0aa928559add4abcc95ce54aa2\"}], \"x_generator\": {\"engine\": \"ADPogram 0.0.1\"}, \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-09-27T19:39:10.340Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-47176\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-27T18:10:15.456578Z\"}}}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:openprinting:cups:*:*:*:*:*:*:*:*\"], \"vendor\": \"openprinting\", \"product\": \"cups\", \"versions\": [{\"status\": \"affected\", \"version\": \"2.0.1\"}], \"defaultStatus\": \"unknown\"}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-27T18:12:36.330Z\"}}], \"cna\": {\"title\": \"cups-browsed binds to `INADDR_ANY:631`, trusting any packet from any source\", \"source\": {\"advisory\": \"GHSA-rj88-6mr5-rcw8\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.3, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N\", \"integrityImpact\": \"LOW\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}}], \"affected\": [{\"vendor\": \"OpenPrinting\", \"product\": \"cups-browsed\", \"versions\": [{\"status\": \"affected\", \"version\": \"<= 2.0.1\"}]}], \"references\": [{\"url\": \"https://github.com/OpenPrinting/cups-browsed/security/advisories/GHSA-rj88-6mr5-rcw8\", \"name\": \"https://github.com/OpenPrinting/cups-browsed/security/advisories/GHSA-rj88-6mr5-rcw8\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/OpenPrinting/cups-filters/security/advisories/GHSA-p9rh-jxmq-gq47\", \"name\": \"https://github.com/OpenPrinting/cups-filters/security/advisories/GHSA-p9rh-jxmq-gq47\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/OpenPrinting/libcupsfilters/security/advisories/GHSA-w63j-6g73-wmg5\", \"name\": \"https://github.com/OpenPrinting/libcupsfilters/security/advisories/GHSA-w63j-6g73-wmg5\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/OpenPrinting/libppd/security/advisories/GHSA-7xfx-47qg-grp6\", \"name\": \"https://github.com/OpenPrinting/libppd/security/advisories/GHSA-7xfx-47qg-grp6\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/OpenPrinting/cups-browsed/blob/master/daemon/cups-browsed.c#L13992\", \"name\": \"https://github.com/OpenPrinting/cups-browsed/blob/master/daemon/cups-browsed.c#L13992\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://www.cups.org\", \"name\": \"https://www.cups.org\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://www.evilsocket.net/2024/09/26/Attacking-UNIX-systems-via-CUPS-Part-I\", \"name\": \"https://www.evilsocket.net/2024/09/26/Attacking-UNIX-systems-via-CUPS-Part-I\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"CUPS is a standards-based, open-source printing system, and `cups-browsed` contains network printing functionality including, but not limited to, auto-discovering print services and shared printers. `cups-browsed` binds to `INADDR_ANY:631`, causing it to trust any packet from any source, and can cause the `Get-Printer-Attributes` IPP request to an attacker controlled URL. When combined with other vulnerabilities, such as CVE-2024-47076, CVE-2024-47175, and CVE-2024-47177, an attacker can execute arbitrary commands remotely on the target machine without authentication when a malicious printer is printed to.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-1327\", \"description\": \"CWE-1327: Binding to an Unrestricted IP Address\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2024-10-02T19:16:51.368Z\"}}}",
         cveMetadata: "{\"cveId\": \"CVE-2024-47176\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-10-02T19:16:51.368Z\", \"dateReserved\": \"2024-09-19T22:32:11.962Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2024-09-26T21:13:05.913Z\", \"assignerShortName\": \"GitHub_M\"}",
         dataType: "CVE_RECORD",
         dataVersion: "5.1",
      },
   },
}


Log in or create an account to share your comment.

Security Advisory comment format.

This schema specifies the format of a comment related to a security advisory.

UUIDv4 of the comment
UUIDv4 of the Vulnerability-Lookup instance
When the comment was created originally
When the comment was last updated
Title of the comment
Description of the comment
The identifier of the vulnerability (CVE ID, GHSA-ID, PYSEC ID, etc.).



Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.