A deep dive into CVE-2024-47176, CVE-2024-47076, CVE-2024-47175, and CVE-2024-47177. A remote unauthenticated attacker can silently replace existing printers or install new ones with a malicious one, resulting in arbitrary command execution (on the computer) when a print job is started.
Timestamps:
0:00 – Introduction
1:45 – Vulnerability Overview
5:50 – Shodan Impact
7:04 – What is CUPS?
8:15 – The Internet Printing Protocol (IPP)
10:00 – Proof of Concept
19:05 – Remote Code Execution
26:10 – Getting a Shell
32:20 – Mitigation
References:
–
–
–
[ad_2]
source
Awesome stuff. Thank you for covering this!
Very nice! Thanks for sharing. Still: please put your image/cam on your lower right instead as it covers up stuff that you are trying to present and it beats the point of presenting something since only you can see it while presenting it.
Thank you dude. First time messing with commands in the terminal. Cups-browsed service removed. This happened at a strange time. Kind of new to Linux and someone else in the house just bought a printer which I noticed popping up in the network lol. I didn't feel very at risk although the status command did indicate vulnerable.
Great vid and POC
Totally over rated, Most distributions have fixed it by ether removing the daemon, or disabling it. This is not Windows were it takes them for weeks to fix anything.
Nice explanation! Thanks
31:58 Your telnet expects "rn" newline sequences while the remote terminal only prints "n". After skimming the manpage, I think the onlcr option in stty can address that.
awesome poc. thanks for the video
Awesome demo. Great narration. Thank you! I am not a linux person, what surprised me is that apparently it seems common practice that network printers located outside your LAN can simply advertise themselves to your linux box. Mitigation imho would be fixing firewall settings or adding OS specific protection against accepting IPs outside your home turf. If this exploit is based on mDNS, I would doubt though that mDNS would be sble to cross your subnet in the first place. Or did I miss a crucial point? I have to admit I have definitely blind spots when it comes to Linux π Thanks anyway for taking the time & explaining the mechanics behind this in such a well paced way, I am sure it helps many people better judge their personal risk.
Rather than trying to come up with a printer brand just call it "Print to PDF". I guarantee most enteprise workers would fall for it. You can even make the command actually produce a pdf file and they wouldn't notice the impact.
Dude, I was watching this video 2 days ago when you had 999 subscribers. Now you have 1.41k. Nice!! Great explanation indeed. Loved it
Loved the lab demo. Great video!
Awesome. Thanks. π₯²
8:20 @PirateSoftware REF π
ππ¨ EvilPrinter
Ubuntu had the patched CUPS packages out early that morning ( West Coast US )
Not interesting really. Problem is.. cups.. desktop.. NAT.. != normally on public IP… So it makes it incredibly boring.. and no one in their right mind put it on the internet.. But as a horizontal vector.. sure
Really great explanation!
Great video, earned a sub bro!!!
Amazing video man.
Loved the way you went into detail and explained everything.
Why this is so highly rated?
Well I could bet on "now printers work fine, we will fix issue later". Later comes never and everybody forgets about it. π
i will keep my macbook no linux
Proper NAT, and keeping your local network secure is important, obviously port 631 should be blocked on your public network facing nics.
this channel is such a gem bro hope you get more subs soon! Edit: btw do you know your site is down it may be my filters but i dont think so
So, for a user behind NAT, there's nothing to worry about?
You didn't really do anything wrong except not align xterm with your terminal sizing. You I believe were using xterm-256-color but regardless you can fix it with exporting the terminal size with stty rows and columns.
Good video.
subbed
hey congrats on hitting 1000 subscriber. I'm the 1000th subscriber
The vulnerability is concerning, but of more concern is THE LINUX COMMUNITY (not the developers) trying to play down the seriousness.
Great video
Great video and explanation
thanks
Thanks for the thorough demo.