CVE-2024-35235

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.8 and earlier, when starting the cupsd server with a Listen configuration item pointing to a symbolic link, the cupsd process can be caused to perform an arbitrary chmod of the provided argument, providing world-writable access to the target. Given that cupsd is often running as root, this can result in the change of permission of any user or system files to be world writable. Given the aforementioned Ubuntu AppArmor context, on such systems this vulnerability is limited to those files modifiable by the cupsd process. In that specific case it was found to be possible to turn the configuration of the Listen argument into full control over the cupsd.conf and cups-files.conf configuration files. By later setting the User and Group arguments in cups-files.conf, and printing with a printer configured by PPD with a FoomaticRIPCommandLine argument, arbitrary user and group (not root) command execution could be achieved, which can further be used on Ubuntu systems to achieve full root command execution. Commit ff1f8a623e090dee8a8aadf12a6a4b25efac143d contains a patch for the issue.

CUPS is the standards-based, open source printing system developed by Apple Inc. for UNIX®-like operating systems. CUPS uses the Internet Printing Protocol (IPP) to support printing to local and network printers..

Security Fix(es):

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.8 and earlier, when starting the cupsd server with a Listen configuration item pointing to a symbolic link, the cupsd process can be caused to perform an arbitrary chmod of the provided argument, providing world-writable access to the target. Given that cupsd is often running as root, this can result in the change of permission of any user or system files to be world writable. Given the aforementioned Ubuntu AppArmor context, on such systems this vulnerability is limited to those files modifiable by the cupsd process. In that specific case it was found to be possible to turn the configuration of the Listen argument into full control over the cupsd.conf and cups-files.conf configuration files. By later setting the User and Group arguments in cups-files.conf, and printing with a printer configured by PPD with a FoomaticRIPCommandLine argument, arbitrary user and group (not root) command execution could be achieved, which can further be used on Ubuntu systems to achieve full root command execution. Commit ff1f8a623e090dee8a8aadf12a6a4b25efac143d contains a patch for the issue. (CVE-2024-35235)

The Common UNIX Printing System (CUPS) provides a portable printing layer for Linux, UNIX, and similar operating systems.

Security Fix(es):

• cups: Cupsd Listen arbitrary chmod 0140777 (CVE-2024-35235)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.8 and earlier, when starting the cupsd server with a Listen configuration item pointing to a symbolic link, the cupsd process can be caused to perform an arbitrary chmod of the provided argument, providing world-writable access to the target. Given that cupsd is often running as root, this can result in the change of permission of any user or system files to be world writable. Given the aforementioned Ubuntu AppArmor context, on such systems this vulnerability is limited to those files modifiable by the cupsd process. In that specific case it was found to be possible to turn the configuration of the Listen argument into full control over the cupsd.conf and cups-files.conf configuration files. By later setting the User and Group arguments in cups-files.conf, and printing with a printer configured by PPD with a FoomaticRIPCommandLine argument, arbitrary user and group (not root) command execution could be achieved, which can further be used on Ubuntu systems to achieve full root command execution. Commit ff1f8a623e090dee8a8aadf12a6a4b25efac143d contains a patch for the issue.

The Common UNIX Printing System (CUPS) provides a portable printing layer for Linux, UNIX, and similar operating systems.

Security Fix(es):

• cups: Cupsd Listen arbitrary chmod 0140777 (CVE-2024-35235)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The Common UNIX Printing System (CUPS) provides a portable printing layer for Linux, UNIX, and similar operating systems.

Security Fix(es):

• cups: Cupsd Listen arbitrary chmod 0140777 (CVE-2024-35235)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.8 and earlier, when starting the cupsd server with a Listen configuration item pointing to a symbolic link, the cupsd process can be caused to perform an arbitrary chmod of the provided argument, providing world-writable access to the target. Given that cupsd is often running as root, this can result in the change of permission of any user or system files to be world writable. Given the aforementioned Ubuntu AppArmor context, on such systems this vulnerability is limited to those files modifiable by the cupsd process. In that specific case it was found to be possible to turn the configuration of the Listen argument into full control over the cupsd.conf and cups-files.conf configuration files. By later setting the User and Group arguments in cups-files.conf, and printing with a printer configured by PPD with a FoomaticRIPCommandLine argument, arbitrary user and group (not root) command execution could be achieved, which can further be used on Ubuntu systems to achieve full root command execution. Commit ff1f8a623e090dee8a8aadf12a6a4b25efac143d contains a patch for the issue.

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.8 and earlier, when starting the cupsd server with a Listen configuration item pointing to a symbolic link, the cupsd process can be caused to perform an arbitrary chmod of the provided argument, providing world-writable access to the target. Given that cupsd is often running as root, this can result in the change of permission of any user or system files to be world writable. Given the aforementioned Ubuntu AppArmor context, on such systems this vulnerability is limited to those files modifiable by the cupsd process. In that specific case it was found to be possible to turn the configuration of the Listen argument into full control over the cupsd.conf and cups-files.conf configuration files. By later setting the User and Group arguments in cups-files.conf, and printing with a printer configured by PPD with a FoomaticRIPCommandLine argument, arbitrary user and group (not root) command execution could be achieved, which can further be used on Ubuntu systems to achieve full root command execution. Commit ff1f8a623e090dee8a8aadf12a6a4b25efac143d contains a patch for the issue.

• CVE-2024-35235: Patch arbitrary chmod vulnerability in cupsd process when starting server with symbolic link Listen configuration item

• CVE-2024-35235: patch arbitrary chmod vulnerability in cupsd process when starting server with symbolic link Listen configuration item

• CVE-2024-35235: patch arbitrary chmod vulnerability in cupsd process when starting server with symbolic link Listen configuration item

• CVE-2024-35235: patch arbitrary chmod vulnerability in cupsd process when starting server with symbolic link Listen configuration item

When starting the cupsd server with a Listen configuration item pointing to a symbolic link, the cupsd process can be caused to perform an arbitrary chmod of the provided argument, providing world-writable access to the target.

These are all security issues fixed in the cups-2.4.8-1.1 package on the GA media of openSUSE Tumbleweed.

This update for cups fixes the following issues:

• CVE-2024-35235: Fixed a bug in cupsd that could allow an attacker to change the permissions of other files in the system. (bsc#1225365)

This update for cups fixes the following issues:

• CVE-2024-35235: Fixed a bug in cupsd that could allow an attacker to change the permissions of other files in the system. (bsc#1225365)
• Handle local 'Negotiate' authentication response for cli clients (bsc#1223179)

This update for cups fixes the following issues:

• CVE-2024-35235: Fixed a bug in cupsd that could allow an attacker to change the permissions of other files in the system. (bsc#1225365)
• Handle local 'Negotiate' authentication response for cli clients (bsc#1223179)

This update for cups fixes the following issues:

• Version upgrade to 2.4.11: See https://github.com/openprinting/cups/releases CUPS 2.4.11 brings several bug fixes regarding IPP response validation, processing PPD values, Web UI support (checkbox support, modifying printers) and others fixes. Detailed list (from CHANGES.md):

  • Updated the maximum file descriptor limit for cupsd to 64k-1 (Issue #989)
  • Fixed lpoptions -d with a discovered but not added printer (Issue #833)
  • Fixed incorrect error message for HTTP/IPP errors (Issue #893)
  • Fixed JobPrivateAccess and SubscriptionPrivateAccess support for "all" (Issue #990)
  • Fixed issues with cupsGetDestMediaByXxx (Issue #993)
  • Fixed adding and modifying of printers via the web interface (Issue #998)
  • Fixed HTTP PeerCred authentication for domain users (Issue #1001)
  • Fixed checkbox support (Issue #1008)
  • Fixed printer state notifications (Issue #1013)
  • Fixed IPP Everywhere printer setup (Issue #1033) Issues are those at https://github.com/OpenPrinting/cups/issues In particular CUPS 2.4.11 contains those commit regarding IPP response validation and processing PPD values:
  • "Quote PPD localized strings" https://github.com/OpenPrinting/cups/commit/1e6ca5913eceee906038bc04cc7ccfbe2923bdfd plus a cleanup to "Fix warnings for unused vars" https://github.com/OpenPrinting/cups/commit/2abe1ba8a66864aa82cd9836b37e57103b8e1a3b

• Version upgrade to 2.4.10: See https://github.com/openprinting/cups/releases CUPS 2.4.10 brings two fixes:

  • Fixed error handling when reading a mixed 1setOf attribute.
  • Fixed scheduler start if there is only domain socket to listen on (Issue #985) which is fix for regression after fix for CVE-2024-35235 in scenarios where is no other listeners in cupsd.conf than domain socket created on demand by systemd, launchd or upstart. Issues are those at https://github.com/OpenPrinting/cups/issues

• Version upgrade to 2.4.9: See https://github.com/openprinting/cups/releases CUPS 2.4.9 brings security fix for CVE-2024-35235 and several bug fixes regarding CUPS Web User Interface, PPD generation and HTTP protocol implementation. Detailed list (from CHANGES.md):

  • Fixed domain socket handling (CVE-2024-35235)
  • Fixed creating of cupsUrfSupported PPD keyword (Issue #952)
  • Fixed searching for destinations in web ui (Issue #954)
  • Fixed TLS negotiation using OpenSSL with servers that require the TLS SNI extension.
  • Really raised cups_enum_dests() timeout for listing available IPP printers (Issue #751)...
  • Fixed Host header regression (Issue #967)
  • Fixed DNS-SD lookups of local services with Avahi (Issue #970)
  • Fixed listing jobs in destinations in web ui. (Apple issue #6204)
  • Fixed showing search query in web ui help page. (Issue #977) Issues are those at https://github.com/OpenPrinting/cups/issues Apple issues are those at https://github.com/apple/cups/issues

• Update to version 2.4.8: See https://github.com/openprinting/cups/releases CUPS 2.4.8 brings many bug fixes which aggregated over the last half a year. It brings the important fix for race conditions and errors which can happen when installing permanent IPP Everywhere printer, support for PAM modules password-auth and system-auth and new option for lpstat which can show only the successful jobs. Detailed list (from CHANGES.md):

  • Added warning if the device has to be asked for 'all,media-col-database' separately (Issue #829)
  • Added new value for 'lpstat' option '-W' - successfull - for getting successfully printed jobs (Issue #830)
  • Added support for PAM modules password-auth and system-auth (Issue #892)
  • Updated IPP Everywhere printer creation error reporting (Issue #347)
  • Updated and documented the MIME typing buffering limit (Issue #925)
  • Raised 'cups_enum_dests()' timeout for listing …

Rory McNamara discovered that when starting the cupsd server with a Listen configuration item, the cupsd process fails to validate if bind call passed. An attacker could possibly trick cupsd to perform an arbitrary chmod of the provided argument, providing world-writable access to the target.