CVE-2024-47175: CUPS libppd Vulnerability Leading to Potential Remote Code Execution
Summary
CVE-2024-47176: CUPS is a standards-based, open-source printing system, and libppd can be used for legacy PPD file support. Affects cups across 2 version ranges.
< 2.4.9-r1
< d681747ebf12602cb426725eb8ce2753211e2477
Fixed in 2.4.9-r1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
CUPS (Common UNIX Printing System) is a standards-based, open-source printing system that allows a computer to act as a print server. It supports various printing protocols and provides a user-friendly interface for managing print jobs. The libppd library within CUPS is responsible for handling legacy PPD (PostScript Printer Description) files, which define the capabilities of printers. However, a vulnerability in libppd can lead to serious security risks, particularly when user-controlled input is involved.
Vulnerability Detail
The vulnerability arises from the libppd function ppdCreatePPDFromIPP2, which fails to properly sanitize IPP (Internet Printing Protocol) attributes when creating the PPD buffer. This lack of sanitization can be exploited in conjunction with other functions, such as cfGetPrinterAttributes5, allowing an attacker to inject malicious input. This vulnerability can lead to remote code execution (RCE) when exploited, particularly through the Foomatic printing system, making it a critical security concern.
How To Fix
Minimum fixed version
2.4.9-r1
This is the first release that contains the fix.
sudo apk add --upgrade cupsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can restrict access to the CUPS service to trusted networks only, minimizing exposure to potential attacks. Additionally, disabling the use of Foomatic until the vulnerability is patched can help mitigate risks.
Conclusion
CVE-2024-47175 is a critical vulnerability in the CUPS printing system that poses significant security risks due to improper input sanitization in the libppd library. Users are strongly advised to update their systems to the latest versions to mitigate the risk of remote code execution. Implementing temporary workarounds can help reduce exposure until a fix is applied.
See every vulnerability recorded for cups →
FAQ
CVE-2024-47175 is a vulnerability in the CUPS printing system's libppd library that can lead to remote code execution due to improper sanitization of user input.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which allows you to monitor and alert for open-source vulnerabilities without requiring installation.
Exploitation of this vulnerability can lead to remote code execution, allowing attackers to run arbitrary code on the affected system, potentially compromising sensitive data and system integrity.
Yes, you can restrict access to the CUPS service and disable Foomatic as a temporary measure until the vulnerability is patched.
You can find more information about CUPS and its vulnerabilities on the official CUPS website and security advisories related to the software.
Related vulnerabilities
Recent vulnerabilities recorded for cups.
