发布时间: 2024年9月26日
修改时间: 2024年10月2日
CUPS is a standards-based, open-source printing system, and `cups-browsed` contains network printing functionality including, but not limited to, auto-discovering print services and shared printers. `cups-browsed` binds to `INADDR_ANY:631`, causing it to trust any packet from any source, and can cause the `Get-Printer-Attributes` IPP request to an attacker controlled URL. When combined with other vulnerabilities, such as CVE-2024-47076, CVE-2024-47175, and CVE-2024-47177, an attacker can execute arbitrary commands remotely on the target machine without authentication when a malicious printer is printed to.
| NVD | openEuler | |
|---|---|---|
| CVSS评分 | 5.3 | None |
| 公告名 | 概要 | 发布时间 |
|---|---|---|
| KylinSec-SA-2024-3926 | cups security update | 2024年10月12日 |
| 产品 | 包 | 状态 |
|---|---|---|
| KY3.4-5A | cups | Fixed |
| KY3.5.2 | cups | Fixed |
| KY3.3-9 | cups | Fixed |
| KY3.2-8 | cups | Unaffected |
| KY3.0-11 | cups | Unaffected |
