erroneo.us
Search all guides⌘K

Digest · Thursday

Security digest: September 26, 2024

1 editorial brief and 1 critical advisory.

All digests · RSS · Markdown

Take stock

  • Check exposure: CUPS RCE. Linux and Unix desktops, laptops and print servers running cups-browsed with UDP 631 reachable from untrusted networks, and anyone whose hosts answer UDP 631 on the internet.
  • npm: 1 critical advisory (agnai). Check with npm audit (or: npm ls <package>).
  • None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Editorial briefs

Check exposure

· Vulnerability · CVE-2024-47176, CVE-2024-47076

CUPS cups-browsed RCE Chain: Real, but Needs a Print Job

Not the internet-ending bug the pre-disclosure hype suggested: code runs only when someone prints to the rogue printer, as the unprivileged lp user; but nothing should expose UDP 631 to the internet, and exposed hosts can be abused for DDoS.

Must act: Linux and Unix desktops, laptops and print servers running cups-browsed with UDP 631 reachable from untrusted networks, and anyone whose hosts answer UDP 631 on the internet.

Can relax: Servers and containers without cups-browsed installed or running, and hosts that firewall UDP 631 and have applied distribution updates.

  1. Check whether cups-browsed runs: systemctl status cups-browsed
  2. If you do not need network printer discovery, stop and disable it: sudo systemctl disable --now cups-browsed
  3. If you need it, set BrowseRemoteProtocols none (or remove 'cups') in /etc/cups/cups-browsed.conf and restart

Read the brief →

Known exploited (CISA KEV) 0

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

None.

Critical advisories by ecosystem 1

GitHub-reviewed advisories rated critical, published this day (Pacific time).

npm 1

Check: npm audit (or: npm ls <package>)