Remediation for CUPS Vulnerabilities: CVE-2024–47076, CVE-2024–47175, CVE-2024–47176, CVE-2024–47177

by@alchemist

CVE-2024–47177 9 Critical Severity

python3 CVE-2024–47177-xremediation.py

Description

Introduction

Following the discovery of multiple significant vulnerabilities in CUPS (Common UNIX Printing System), system administrators must act immediately to reduce possible hazards. These vulnerabilities (CVE-2024–47076, CVE-2024–47175, CVE-2024–47176, and CVE-2024–47177) make systems vulnerable to remote code execution (RCE) attacks. This blog will go over a remediation script that helps protect your system by stopping vulnerable services, preventing critical attack routes, and minimizing risks until fixes become available.

Overview of CVEs

• CVE-2024–47076: Improper validation of IPP characteristics in libcupsfilters enables attacker-controlled data to be sent to CUPS.
• CVE-2024–47175: The libppd library fails to sanitize IPP data while creating PostScript Printer Description (PPD) files, leading to the introduction of malicious code.
• CVE-2024–47176: The cups-browsed service connects to all accessible IP addresses, exposing UDP port 631 and receiving possibly malicious IPP packets.
• CVE-2024–47177 involves arbitrary command execution with the FoomaticRIPCommandLine PPD parameter in cups-filters.

Remediation Strategy

To mitigate these vulnerabilities, the following measures are required.

• Stop and deactivate the cup-browsed service. This prevents the service from listening for malicious IPP packets on UDP port 631.
• Block UDP port 631. This lowers the likelihood of remote attackers abusing the open port.
• Ensure that services are not resumed during reboot. Disabling the services permanently will protect your machine during reboots.

How the Script Works

1. Stops the cups-browsed Service: This prevents the system from accepting IPP packets from potentially malicious sources.
2. Disables the Service: This ensures the cups-browsed service does not start again during reboot, maintaining the system's protection.
3. Blocks UDP Port 631: Closing this port prevents external attackers from exploiting it to gain access via IPP.
4. Reloads Firewall Rules: Ensures that changes made by UFW are active immediately.

Running the Script

• Save the script as remediation.py.
• Run it with root privileges:sudo python3 remediation.py

Conclusion

This script provides a quick and effective way to reduce your system’s exposure to the CUPS vulnerabilities discovered in 2024.By stopping vulnerable services, disabling automatic restarts, and blocking critical ports, administrators can significantly lower the risk of exploitation until patches are available from Linux distribution maintainers.

Staying vigilant and regularly applying security updates is essential for keeping systems safe. Make sure to follow up with vendor patches once they are released to fully resolve the vulnerabilities​

Tags

#security #CUPS