Vulnerability · Published Sep 26, 2024 · Assigned by GitHub_M
CVE-2024-47176cups-browsed binds to `INADDR_ANY:631`, trusting any packet from any source
Medium 5.3
In plain English
A medium-severity security flaw in cups-browsed from OpenPrinting. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 50.6% (higher than 99% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, Nuclei, public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
CUPS is a standards-based, open-source printing system, and `cups-browsed` contains network printing functionality including, but not limited to, auto-discovering print services and shared printers. `cups-browsed` binds to `INADDR_ANY:631`, causing it to trust any packet from any source, and can cause the `Get-Printer-Attributes` IPP request to an attacker controlled URL. When combined with other vulnerabilities, such as CVE-2024-47076, CVE-2024-47175, and CVE-2024-47177, an attacker can execute arbitrary commands remotely on the target machine without authentication when a malicious printer is printed to.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | cups-filters | 1.20.0-35.el8_10 | ALSA-2024:7463 |
| AlmaLinux:9 | cups-filters | 1.28.7-17.el9_4 | ALSA-2024:7346 |
| AlmaLinux:8 | cups-filters-devel | 1.20.0-35.el8_10 | ALSA-2024:7463 |
| AlmaLinux:9 | cups-filters-devel | 1.28.7-17.el9_4 | ALSA-2024:7346 |
| AlmaLinux:8 | cups-filters-libs | 1.20.0-35.el8_10 | ALSA-2024:7463 |
| AlmaLinux:9 | cups-filters-libs | 1.28.7-17.el9_4 | ALSA-2024:7346 |
| Debian:12 | cups-filters | 1.28.17-3+deb12u1 | DEBIAN-CVE-2024-47176 |
| Debian:12 | cups-filters | 1.28.17-3+deb12u1 | DSA-5778-1 |
| Debian:13 | cups-filters | 1.28.17-5 | DEBIAN-CVE-2024-47176 |
| Debian:14 | cups-filters | 1.28.17-5 | DEBIAN-CVE-2024-47176 |
| Rocky Linux:8 | cups-filters | 0:1.20.0-35.el8_10 | RLSA-2024:7463 |
| Rocky Linux:9 | cups-filters | 0:1.28.7-17.el9_4 | RLSA-2024:7346 |
| Ubuntu:24.04:LTS | cups-browsed | 2.0.0-0ubuntu10.2 | UBUNTU-CVE-2024-47176 |
| Ubuntu:24.04:LTS | cups-browsed | 2.0.0-0ubuntu10.1 | USN-7042-1 |
| Ubuntu:24.04:LTS | cups-browsed | 2.0.0-0ubuntu10.2 | USN-7042-2 |
| Ubuntu:22.04:LTS | cups-filters | 1.28.15-0ubuntu1.4 | USN-7043-4 |
| Ubuntu:22.04:LTS | cups-filters | 1.28.15-0ubuntu1.4 | UBUNTU-CVE-2024-47176 |
| Ubuntu:22.04:LTS | cups-filters | 1.28.15-0ubuntu1.3 | USN-7043-1 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| OpenPrinting | cups-browsed | <= 2.0.1 |
Weakness: CWE-1327 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
References
- https://github.com/OpenPrinting/cups-browsed/security/advisories/GHSA-rj88-6mr5-rcw8 x_refsource_CONFIRM
- https://github.com/OpenPrinting/cups-filters/security/advisories/GHSA-p9rh-jxmq-gq47 x_refsource_MISC
- https://github.com/OpenPrinting/libcupsfilters/security/advisories/GHSA-w63j-6g73-wmg5 x_refsource_MISC
- https://github.com/OpenPrinting/libppd/security/advisories/GHSA-7xfx-47qg-grp6 x_refsource_MISC
- https://github.com/OpenPrinting/cups-browsed/blob/master/daemon/cups-browsed.c#L13992 x_refsource_MISC
- https://www.cups.org x_refsource_MISC
- https://www.evilsocket.net/2024/09/26/Attacking-UNIX-systems-via-CUPS-Part-I x_refsource_MISC
- http://www.openwall.com/lists/oss-security/2024/09/27/6
- https://github.com/OpenPrinting/cups-browsed/commit/1debe6b140c37e0aa928559add4abcc95ce54aa2
- https://security.netapp.com/advisory/ntap-20241011-0001/
- https://lists.debian.org/debian-lts-announce/2024/09/msg00048.html
- http://www.openwall.com/lists/oss-security/2025/09/11/2