Reflecting on the CUPS CVEs

Hi, and welcome to this video! In this video I read and comment the recent CVEs that were discovered by evilsocket on the CUPS project. it is important to realize that while the chain described within the article can be described as "RCE through printing". This means, when a printing event is initiated on the malicious printer, the malicious command is executed. The question on whether this requires user interaction or not depends mainly on the environment under analysis. If the environment has no extra configuration, then it does require user interaction. If however the environment has other services that allow to print by sending specific requests to specific ports, then there are ways to achieve RCE even without user interaction. This is to say that it's hard to describe all the possible risk scenarios without understanding every single possible environment, and also what are the most probably environments in, for example, home LANs or in corporate LANs and so forth. Ultimately, the takeway is: disable CUPS if you do not need to print stuff, and if you need to print stuff, be careful on how your instance is configured, and do not accept connection from arbitrary IPs. ------------------------- TIMESTAMP 00:00 Introduction 03:30 Impact 08:20 Remediation 09:35 Reading UDP packet from arbitrary IPs 13:50 Registering malicious printer 16:00 Injecting data into temporary PPD file 17:55 Command Execution with cupsFilter2 and foomatic-rip 20:33 Chain Overview 21:37 The CVSS 9.9 was wrongly computed 25:00 foomatic-rip cannot be validated 27:30 The relationship between dev and sec ------------------------- REFERENCES Material: https://github.com/LeonardoE95/yt-en/... Writeup by evilsocket: https://www.evilsocket.net/2024/09/26... ------------------------- CONTACTS Blog: https://blog.leonardotamiano.xyz/ Github: https://github.com/LeonardoE95?tab=re... Support: https://www.paypal.com/donate/?hosted...