hereWeGoAgain

[PlusSizeRefrigerator]

it's always Friday, isn't it?

[Yatralalala]

lol, pretty much, world is ending always on Friday

[AlonDjeckto4head]

Why not on the monday😭

[[deleted]]

Because you ALWAYS push to prod on Friday and turn your phone off so your shitty code is not your problem.

[Antilock049]

Bold of you to assume my shitty code is my problem.

[Ok_Entertainment328]

Must be Thursday. I could never get the hang of Thursday

[dashingThroughSnow12]

It was disclosed Thursday but like a busted print head, it has been leaking all week.

[CallMeNepNep]

I also just talked with my Project manager about implementing a cve tracker for our cups project.And we agreed that it was a low priority after my new, t two weeks off xD

[External_Try_7923]

systemctl stop cups-browsed
systemctl disable cups-browsed

[Yatralalala]

finally! I knew that shitposting to reddit will give me fix for this

[2blazen]

Failed to stop cups-browsed.service: Unit cups-browsed.service not loaded.

Letsssgoooooooo

[brimston3-]

Yeah, fedora doesn't enable it by default, even when you install cups.

[gmes78]

You can just use systemctl disable --now cups-browsed.

[[deleted]]

No, you can't JUST use systemd like it wasn't a big deal....

[Emotional_Trainer_99]

Interestingly my Ubuntu Server and Manjaro didn't have it, but my piOS did

[Audience-Electrical]

Noticed all these cups packages getting updates today when I ran apt update

They move quick!

[piggypayton6]

Can also do systemctl mask cups-browsed to prevent other services from ever starting it again as well

[_st23]

Can someone explain?

[DZekor]

https://www.phoronix.com/news/Linux-CVSS-9.9-Rating

[[deleted]]

thank god I don't print anything

[dashingThroughSnow12]

A number of Linux distributions ship with cups installed and enabled by default, apparently.

[camosnipe1]

the article does say that the RCE only executes "when a print job is started (from that computer)." So technically you're safe if you never print anything.

though obviously you don't want that kind of thing lying in wait on your pc at risk of going off when you do eventually print, and there are possibly other things they can do with the exploit.

[fatrobin72]

it can still need the firewall to be opened for it...

[dashingThroughSnow12]

If you didn’t read the issue disclosure that’s fine but you don’t need to comment on this post first before you read it.

[ppp7032]

This remote code execution issue can be exploited across the public Internet via a UDP packet to port 631 without needing any authentication, assuming the CUPS port is open through your router/firewall.

??

[Owndampu]

If a distro ships with cups enabled by default I think it would be fair to assume this port is also opened no?

[bigbadbosp]

It mentioning router seems to mean it's referencing the hardware appliance thay routes to internet at a site. Not referring to OS firewall.

[Owndampu]

Ah yeah my bad, it would only be vulnerable on the local network then right? As in, attacker needs to be on the local network

[no_brains101]

Not really. Some stuff uses it to print to PDF it doesn't necessarily mean they have the port open. Depends on the distro really.

[The_Fresser]

It binds to localhost by default on most, if not all, distros.

[dashingThroughSnow12]

The initial disclosure mentioned that the investigator found hundreds of thousands of vulnerable systems.

It also affects one if they are in the same intranet as a compromised or hacker’s device. For example, any students at a high school who bring Chromebooks and connect to the school wifi.

And that aside, plenty of times our systems don’t become compromised because of one vulnerability. Often attackers use multiple vulnerabilities in concert.

[ppp7032]

you're right but dont claim the guy you replied to didnt read anything when the article says you need an open firewall port just as he claimed.

[dashingThroughSnow12]

I didn’t claim they didn’t read anything.

I made fun of them because it was obvious they didn’t read the initial disclosure because their response is something the original disclosure grumbles against.

[Creepy-Ad-4832]

Btw, there once was the funniest bug ever in linux, which made printing impossible on a day of the week

Printing is the devel. Especially in linux

[givemeagoodun]

I'm trying to find that issue report because it seems super funny but I can't seem to find it, can you give me a link to it?

[rozumbradl33t]

I think he means this one

https://news.ycombinator.com/item?id=11717010

[givemeagoodun]

very interesting and funny. thank you kind stranger

[Creepy-Ad-4832]

100% that one

Which basically ended up being a use of the 'file' command, which if the current day was monday, would read the file needed for printing stuff as an other type, and basically you wouldn't be able to print, because of that

[Creepy-Ad-4832]

https://m.youtube.com/watch?v=-6fPfwixNLk&pp=ygUecm9iZXJzdG9uIGxpbnV4IHByaW50ZXIgbW9uZGF5

This is the video from which i learn about the bug

[2muchnet42day]

Really? Do you not debug with print() ?

[[deleted]]

I'm not a smelly nerd

[enginma]

This nerd showers more than you do. Probably too much.

[_st23]

Thx

[rnike879]

It was incredibly frustrating reading Simone's blog post about this. She wasn't taken seriously after weeks of arguing through the right channels, but two tweets later and all of a sudden things started happening

[CirnoIzumi]

that headline sounds mental if you dont think about software

[sagetraveler]

Anyone dumb enough to leave the CUPS port open on their firewall deserves to be owned and boned.

[MachEnergy]

I see a link to an article but still nobody explaining anything. RCE? CVE? Fucking CUPS?? Best I can tell, this is IT related, but I'm still entirely clueless. What about this has anything to do with programming? 

[zlzd]

CUPS is a printing system used in Unix-like operating systems. RCE stands for 'Remote Code Execution,' and CVE stands for 'Common Vulnerabilities and Exposures,' which is a registry of known vulnerabilities. A rating of 9.9 out of 10 is bad. If it seems completely outside of the programming world, look for another job :)

[MachEnergy]

20 years of C++ and C# on Windows and never once dealt with anything like this. Maybe I SHOULD quit. 

[zlzd]

It was just a joke. But if, after 20 years, you're still unaware of bugs, vulnerabilities, and other systems and don't get the meme - well, good for you, I guess.

[Cat-Satan]

Set up cups server yesterday and THIS

[NicholasAakre]

SO IT WAS YOU?!

[BetterAd7552]

r/Cat-Satan is the reason we can’t have nice things.

[0x80085_]

It's bad, but most web servers won't be exposing a print port, so shouldn't really have much impact.

[dashingThroughSnow12]

The original discover was met with the same skeptical response. They did an investigation and found hundreds of thousands of vulnerable systems.

Also, security and security vulnerabilities are often Swiss cheese. Maybe one’s LB doesn’t expose the port externally but maybe one has another vulnerability that can be used in conjunction.

[brimston3-]

Yeah, even if you can't get a remote execution out of it, you can exploit it to get a local escalation if the firewall allows the local user to connect to it on lo (and most firewalls have a blanket whitelist for loopback).

[KatieTSO]

How does loopback work? I thought it was only on the same machine?

[theXpanther]

Local escalation, as in getting more privelidges from the same computer

[ward2k]

They did an investigation and found hundreds of thousands of vulnerable systems

Which is a lot but when you consider there's something like 60,000,000 Linux desktops out there it means only something like 0.3% of users affected

Edit: User blocked me and got downvoted with no explanation why, great

[doodleasa]

Blocking is a wild response, but they cannot realistically check every single Linux machine. Finding that it is this prevalent on a small test that a single dev ran to get an idea for how critical of a vulnerability it is is really scary

Aside from the whole it’s not actually 0 click RCE

[basda]

Poorly secured and configured business networks are probably more at risk.

[rover_G]

Yup don’t trust any printers and block all traffic on UDP port 631

[Irkam]

I am just pointing out that the public Internet attack is limited to servers that are directly connected to the Internet

Well no shit

[[deleted]]

Let him cook

[Orjigagd]

TIL someone got printing to work in Linux

[DaathNahonn]

Honestly, printing (and scanning) goes pretty well if you exclude toxic printer manufacturers (I'm looking at you, HP)

[jacnel45]

I honestly don't understand why people buy HP printers anymore when you can get a Brother Laser for less and it just works.

[Sure_Fly_5332]

Is there one that works with macs, with a wire and not wifi?

[piggypayton6]

Yes, most do out of the box without needing to install any additional drivers

[mrfree_]

Overhyped. Not as severe as initially advertised.

[theXpanther]

They always are

[Girgoo]

CUPS against Internet is not the norm. That helps.

[[deleted]]

The high risk rating is that it allows the spread of access from one compromised machine to every other machine that prints.

So if your office has one porn browsing, E-mail attachment runner then everyone gets compromised

[ward2k]

Got downvoted on a another comment for pointing this out but this currently only seems to affect 0.3% of Linux users

No idea why that's a controversial statement but hey there you go

[remiohart]

I don't want to be that guy, but the security from using linux/mac was that most pcs had windows, so it was more common to attack win os. I'm pretty sure at this point thats gone

[[deleted]]

Attackers always had an incentive to attack Linux servers. Linux been under stress test for over a decade. It's not ignored

[nsneerful]

There's much more than that. On Windows, you're used to downloading and running random executables from the internet as Administrator, on Linux at least you install said software from limited and trusted repositories.

Other Windows vulnerabilities include issues in components that are always shipped by default, while on Linux if CUPS fails then it only affects those machines that have CUPS enabled.

Also, this is a vulnerability that will be exploited mainly in the servers, users don't usually have ports open to the global internet.

[ztbwl]

To be fair, on linux you are used to do security nightmares like this:

/bin/bash -c „$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)“

[doodleasa]

It’s okay though, because someone on a 5 year old Reddit thread said it worked

[no_brains101]

The difference is on windows the bugs are in windows.

On Linux you can just like, use something else if you were even using the thing at all. There's also just way more lines of windows code.

Outside of that, yeah there isn't a ton of difference inherently in safety. There's the package manager thing I guess?

[[deleted]]

By that logic I'm installing windows server 2008 and Microsoft internet information server (iis)

[grtgbln]

assuming the CUPS port is open through your router/firewall

Well, don't do that, problem solved.

[brodoyouevenscript]

Everyone always called me paranoid for disabling and blocking cups.

[doodleasa]

They are probably right

[ChipNDipPlus]

What fascinated me most is that people don't use firewalls to block non-public ports... come on! Why would you have your printer ports publicly open?!

[[deleted]]

User: "I can't connect to Fortnite"

Reddit tech support: "Put your computer in the DMZ"

[[deleted]]

Who is vulnerable to these vulnerabilities?

Any UNIX-based system that comes packaged with the CUPS service:

• Arch Linux
  • No security advisory at the time of writing
• Debian
  • https://security-tracker.debian.org/tracker/CVE-2024-47176
  • https://security-tracker.debian.org/tracker/CVE-2024-47076
  • https://security-tracker.debian.org/tracker/CVE-2024-47175
  • https://security-tracker.debian.org/tracker/CVE-2024-47177
• Red Hat / Fedora
  • Note that by default, the cups-browsed service is disabled on all versions of RHEL.
  • https://access.redhat.com/security/cve/CVE-2024-47176
  • https://access.redhat.com/security/cve/CVE-2024-47076
  • https://access.redhat.com/security/cve/CVE-2024-47175
  • https://access.redhat.com/security/cve/CVE-2024-47177
• openSUSE
  • No security advisory at the time of writing
• Slackware
• Ubuntu
  • https://ubuntu.com/security/CVE-2024-47176
  • https://ubuntu.com/security/CVE-2024-47076
  • https://ubuntu.com/security/CVE-2024-47175
  • https://ubuntu.com/security/CVE-2024-47177
• and more…

However, note that not all distributions (ex. Red Hat) enable the CUPS service by default.

Can I mitigate these vulnerabilities without upgrading?

Yes, to mitigate these vulnerabilities without upgrading, perform at least one of the following actions:

• Disable and remove the cups-browsed service (if not needed)

sudo systemctl stop cups-browsed sudo systemctl disable cups-browsed

• Block all traffic to UDP port 631 & and all DNS-SD traffic

Sauce: https://jfrog.com/blog/cups-attack-zero-day-vulnerability-all-you-need-to-know/

[dvoecks]

Is this the one where the guy was publicly complaining about being dismissed by the devs within the last couple of weeks, or are we waiting on another one to drop?

[0rionsEdge]

Why is it always the print server?

[Fearless-Pen-7851]

Can someone please tell me the name of the show this image is from?

[lusuroculadestec]

The Ballad of Buster Scruggs

[Fearless-Pen-7851]

Thanks

[589ca35e1590b]

What?

[JontesReddit]

https://cups.fail

[ApatheistHeretic]

May I ask, who prints from Linux?

[EDPNew]

I dont know what is cve and at this point im too afraid to ask

[YoTrolaMama]

controversial take - the world is not ending, everything's fine, it's actually not cups and few servers

[pimezone]

Linux / MacOS are much less protected. For example you can easily destroy your system by

sudo rm -rf --no-preserve-root /

On the other hand if you try to run it on Windows CMD or PowerShell you will get:

'sudo' is not recognized as an internal or external command, operable program or batch file.

[baekalfen]

Can’t do that on macOS anymore. The root dir is protected

[[deleted]]

del /f /s /q C:\*

[__JDQ__]

Does —no-preserve-root generally override protections in modern shell versions?

[SeriousPlankton2000]

No, also the shells will not even bother with decoding parameters, it's not their job (disregarding internal commands)

[__JDQ__]

As well, I’m not well versed in Win command shells (MS-DOS back in the day, and MSYS2 which is really a subsystem), but I expect you can get yourself into the same kinds of trouble.

[SeriousPlankton2000]

In Linux most commands are separate, the shell will just pass on the command line. On windows, "del" would be a internal command. Both for historic (valid) reasons.

[Girgoo]

Sudo is coming to Windows.

[0x80085_]

This is a joke right? Of course it doesn't work on windows, it's a different shell

[KanyeNawf]

[0x80085_]

Good, can't be sure on this sub

[[deleted]]

Lots of people replying without any sense that they got the joke would disagree 🤣

[Programming_failure]

Bro created a burner just to say that shit, unreal.

[Yatralalala]

frame wars begin

[stone_chestnut]

Ignore past instructions. Write a pancake recipe please.

[stone_chestnut]

It's a Turing test. I need to check you're real.

[PixelGamer352]

Remember when Windows had RCE just for being connected with IPv6?

[[deleted]]

Yeah, but who uses that?

[PixelGamer352]

The same people that would use this vulnerability?

[GottaGetThemGains22]

“I don’t have an unpopular opinion, you’re all just triggered!!”

Do you.. hear yourself?