OpenPrinting CUPS up to 2.4.8 Setting cupsd.conf link following

Summaryinfo

A vulnerability classified as critical has been found in OpenPrinting CUPS up to 2.4.8. Affected is an unknown function of the file cupsd.conf of the component Setting Handler. The manipulation leads to link following. This vulnerability is traded as CVE-2024-35235. An attack has to be approached locally. There is no exploit available. It is recommended to apply a patch to fix this issue.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in OpenPrinting CUPS up to 2.4.8. This issue affects some unknown processing of the file cupsd.conf of the component Setting Handler. The manipulation with an unknown input leads to a link following vulnerability. Using CWE to declare the problem leads to CWE-59. The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource. Impacted is confidentiality. The summary by CVE is:

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.8 and earlier, when starting the cupsd server with a Listen configuration item pointing to a symbolic link, the cupsd process can be caused to perform an arbitrary chmod of the provided argument, providing world-writable access to the target. Given that cupsd is often running as root, this can result in the change of permission of any user or system files to be world writable. Given the aforementioned Ubuntu AppArmor context, on such systems this vulnerability is limited to those files modifiable by the cupsd process. In that specific case it was found to be possible to turn the configuration of the Listen argument into full control over the cupsd.conf and cups-files.conf configuration files. By later setting the User and Group arguments in cups-files.conf, and printing with a printer configured by PPD with a `FoomaticRIPCommandLine` argument, arbitrary user and group (not root) command execution could be achieved, which can further be used on Ubuntu systems to achieve full root command execution. Commit ff1f8a623e090dee8a8aadf12a6a4b25efac143d contains a patch for the issue.

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2024-35235 since 05/14/2024. The exploitation is known to be easy. Attacking locally is a requirement. Additional levels of successful authentication are needed for exploitation. Technical details of the vulnerability are known, but there is no available exploit.

The vulnerability scanner Nessus provides a plugin with the ID 211899 (CBL Mariner 2.0 Security Update: cups (CVE-2024-35235)), which helps to determine the existence of the flaw in a target environment.

Applying the patch ff1f8a623e090dee8a8aadf12a6a4b25efac143d is able to eliminate this problem. The bugfix is ready for download at github.com.

The vulnerability is also documented in the vulnerability database at Tenable (211899). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Printing Software

Vendor

• OpenPrinting

Name

• CUPS

Version

• 2.4.0
• 2.4.1
• 2.4.2
• 2.4.3
• 2.4.4
• 2.4.5
• 2.4.6
• 2.4.7
• 2.4.8

License

• open-source

Website

• Product: https://github.com/OpenPrinting/cups/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion