Simone Margitelli’s post on the find
Margitelli posted a screenshot that implies he submit this bug to Canonical and Red Hat, who rated the vulnerability to have a CVSS of 9.9. If this is true, this bug would be more critical than the infamous Heartbleed, Spectre, and Meltdown exploits. Information is really limited right now about this bug, and also somewhat contradictory. I cannot find a public statement from Red Hat or Canonical confirming the existance of this bug, but have yet to deny it. This is typical for an exploit of this magnitude. However, according to Security Online, both insitutions have confirmed its severity.
Full disclaimer, this thing could be totally overhyped/overblown right now. Its going to take a few weeks before all the information comes out. It wouldn’t be the first time a vulnerability has been overhyped to pressure the dev into fixing it. In the mean time, Linux users should make sure to keep their systems up to date.
The Security Online article only cites Margitelli’s post on the matter. My assumption has been the article used the post as its single source. On one hand, watching MS fuck shit up for years, I want to believe Margitelli. On the other hand, researchers using weird tools and uninterested in reality are why curl is now a CNA.
I’m personally frustrated with Margitelli’s post because it’s all about abandoning responsible disclosure globally rather than naming and shaming (Canonical? Red Hat? Both? Others? If it affects all GNU/Linux I’d expect every single distro maintainer to be named and shamed). Responsible disclosure is our best solution to make sure innocent bystanders don’t get caught in the crossfire. When specific entities don’t abide by responsible disclosure we lambast those specific entities not the entire process built to keep users safe.
It’ll be out in a couple of weeks and then we’ll know exactly which prick has mommy issues over their code
I have zero knowledge about the details and processes involved in security issue disclosure and even I get the feeling something is off about Margitelli’s post.
He can let his findings speak for themselves when they are responsibly disclosed (and then start the sensationalism).
This is a real exploit chain in
cups-browsed. The tl;dr is that it will add basically anything that knows the correct protocol to your list of available printers, and this can be exploited for RCE if you print to the malicious printer. The service listens on all interfaces by default on UDP 631.It is not as horrible as it was marketed, but it’s real and not great. You may or may not have this service running by default; I didn’t on Fedora.
His full write-up is here: https://www.evilsocket.net/2024/09/26/Attacking-UNIX-systems-via-CUPS-Part-I/
Well, then…
sudo systemctl stop cups-browsed sudo systemctl disable cups-browsedCups was due, too much functionality on too many systems, it needed to be more limited and secure by default.
Suspicious how the Twitter and Instagram accounts went private since.
