Skip to main content



OpenPrinting News Flash - cups-browsed Remote Code Execution vulnerability


reshared this

in reply to pnutzh4x0r

Yep. While simple to prepare, this will affect almost nobody, as it requires the user to perform an increasingly rare action in a world that's often going paperless.

Also, the likelihood that a regular user will expose port 631 to the internet is probably close to zero. There's several uncommon pieces that have to be in place for this to work, to the point that it's not a simple matter to execute this exploit.

in reply to Telorand

this will affect almost nobody


Is that really true? From evilsocket.net/2024/09/26/Atta…

Full disclosure, I’ve been scanning the entire public internet IPv4 ranges several times a day for weeks, sending the UDP packet and logging whatever connected back. And I’ve got back connections from hundreds of thousands of devices, with peaks of 200-300K concurrent devices.
in reply to sweng

My guess is that most hits that scan is gonna catch is old enterprise networks, that has not been updated or maintained by security.
in reply to sweng

The very next sentence:

Note that everything that is not Linux has been filtered out [in this filtered list of unique IPs]. That is why I was getting increasingly alarmed during the last few weeks.


They said they were getting duplicates and non-*nix hits with that 300k number, which doesn't help them (i.e. the hundreds of thousands of hits was artificially inflated). So yes, the threat is overblown.

Coupled with the fact that patches are already out, and it's easily mitigated by closing 631, and I don't expect this will be much of a problem for most people.

in reply to Telorand

I'm not sure why you say it's "artificially" inflated. Non-linux systems are also affected.
in reply to sweng

How's that? If I'm running a Windows machine, how would a CUPS exploit affect me?

I'm not asking maliciously, but I genuinely don't grasp how that could be a viable attack vector.

in reply to Telorand

You would be vulnerable on Windows, if you were running CUPS, which you probably are not. But CUPS is not tied to Linux, and is used commonly on e.g. BSDs, and Apple has their own fork for MacOS (have not heard anything about it being vulnerable though).
in reply to Telorand

Wait, which list of filtered IPs are you even talking about? The list in the article is a list of unique kernel versions, not IPs.
in reply to Telorand

ipv6 doesn't give the NAT. A malicious website can mount the attack.
in reply to Telorand

Say I host a malicious server with ipv6 only. You visit the site without NAT. I get your ip and ip:631 is open (unless firewall and listen is restricted to prefix). Usual attack afterwards.

Edit: You need to have ipv6, for example many mobile networks.

This entry was edited (1 year ago)
in reply to serenissi

I have full IPv6, none of my ports that I haven't explicitly whitelisted in the firewall can be accessed from the Internet. I can open a host completely, but it's not default. This is on the most common brand of consumer routers here.

Just because it's not NATted doesn't mean there's no firewall in place.

in reply to Laser

Yeah ofcourse firewall is the good idea here. I personally have firewall on on every device so that I can manage what can connect and from where.

The point is though often people just disable firewalls (some distros do not install/enable by default too) to workarround certain issues quickly like kdeconnect not connecting, bridge not working and such.
That's how I think the whole 'ipv4 NAT is the best (consumer) firewall' concept came popular.

in reply to pnutzh4x0r

I don't know why the guy just assumed every linux and BSD machine runs cups-browsed by default?

It took me literally 5 seconds to check that it's disabled on Fedora by default.

Then he wrote a whole paragraph about how no one should use CUPS for printing because based off of his own analysis, it's some insanely crappy and insecure system.

Which is actually stupid because the only alternative is windows?????????? Which is universally known for printer driver and spooler vulnerabilities.

Then he got mad the the maintainer for patching before his disclosure.....


in reply to m3t00🌎

Man we are so small. Like one of these in the wrong direction could just incinerate our galaxy.
in reply to Cruxifux





I made a script that configures Ubuntu (mainly its GNOME) the way I like it. I also made it work in Debian and Fedora.


It doesn't do any crazy ricing, as I mostly focused on usability tweaks and automatic installation of my must-have extensions. (Tiling, clipboard manager, dash to dock, desktop icons)

Most notable tweaks include:
- clicking on a running app minimizes it
- clicking on a group of apps brings up their previews
- adds minimize, maximize buttons to windows
- installs flatpak, adds flathub
- install flatpak and snap plugins into gnome-software (doesn't work on Fedora)
- installs snap
- installs mtp-tools and gvfs-backends on Debian to be able to transfer files from a connected phone
- adds right click > New File
- Super + Shift + S brings up the area screenshot
- Super + E opens the file manager
- Ctrl + Alt + T opens the terminal

(Those already configured on Ubuntu don't get configured again, obviously.)

I also recorded a short showcase to prove that it works without errors youtu.be/xf739ivb9hg

This entry was edited (1 year ago)
in reply to BrianTheeBiscuiteer

I was recommended this
flathub.org/apps/io.github.vik…
Seems very user friendly and can do everything except for installing software.
in reply to tsugu

Interesting project. Thanks for the share. Just saying Ansible is a more "general purpose" tool, almost a programming language, to configure most anything, not just desktop environments.



Anyone know if the MX creative console from logitech works on Linux (and to what degree?


I kinda want to hook one up to raspberry pi for some home control, but I'm not sure if the software to configure it works on Linux (or how it even presents itself HID-device wise)

I'm sure it'll eventually be reverse engineered and have some custom drivers on github soon, but a quick google came up empty for this new device.

Edit: Oh I just realized this hasn't been released yet, I saw the "buy now" button and assumed it was.

This entry was edited (1 year ago)
in reply to kelvie

It's $269.99 and has 9 programmable buttons. It's designed to control rent-seeking apps like Photoshop.

The Streamdeck XL costs $200 and has 32 programmable buttons. I'm using it to control my dorm room through Home-Assistant, and my robot camera through Bitfocus Companion.

This entry was edited (1 year ago)
in reply to kelvie

Logitech does not support Linux.

Most of the current compatibility of Logitech devices comes from, Linux devs reverse engineering their software, USB standards or from default programing stored in the device.



in reply to m3t00🌎

By the time we see the nova in the coming days, another ~75 will have happened since the one we'll be seeing.
in reply to m3t00🌎

Websites sure have been milking this all year, huh? Must be reliable ad revenue it gets posted so much


1. Oktober 2024, 17:00:00 CEST - GMT+2 - Polytechnischer Werkraum, 02763, Zittau, Deutschland
Oct 1
Offener Treff
Tue 5:00 PM - 7:00 PM
Polytechnischer Werkraum Zittau (Termine)
Chaostreff und Erfahrungsaustausch zu technischen Themen

in reply to John

in reply to John

Why would anyone be running a 32bit application in 2038? It is already hard enough now to continue 32bit support.


Mandelbrot Viewer: a cool program that renders the Mandelbrot Fractal


Hello everyone! This is a small program I made yesterday to render the Mandelbrot Fractal with beautiful colors!

It isn't as fast as other programs (e.g. XaoS) but it is the first good program I have made using OpenGL. I may update it to render some other fractals too in the future (e.g. The Burning Ship).

I hope you like it!

reshared this



Nutidens thinner eller GHB är lustgas. Det är en större klimatbov än bilar utropar ETC i en rubrik. Vilket naturligtvis är trams. I alla fall om vi pratar om lustgas som berusningsmedel. Visserligen är kväveoxider (som lustgas är) kraftiga växthusgaser, betydligt potentare än koldioxid.

blog.zaramis.se/2024/09/29/nut…



Systemd Looking At A Future With More Varlink & Less D-Bus For IPC


reshared this

in reply to petsoi

So, Poettering wants to make life difficult for everyone using something other than his precious again by transitioning from the normal standard for IPC to something hardly anyone has ever heard of or uses that's based on JSON? Seriously? 🤢
in reply to nyan

It's not just "hardly anyone," it's "literally no one." Varlink was invented by the systemd developers out of whole cloth specifically for this purpose.
in reply to Snarwin

This has always been the whole point behind the Trojan Horse that is systemd. Now that Poettering/Red Hat control the entire userspace across virtually all distros, he/they can use it as a vehicle to force all of them to adopt whatever bullshit
he thinks of next.

This is what the Linux ecosystem gave away when they tossed their simple init system to adopt the admittedly convenient solution that is systemd. But in reality, the best solution was always to drop init, and instead replace it with an alternative that was still simple to replace if the need should arise. But now that everyone is stuck on systemd, they're all at the mercy of Poettering's Next Stupid Idea.

Convenience comes at a price. systemd is the Google Chrome of Linux userspace. Get out while you can.

in reply to namingthingsiseasy

Jesus fucking Christ, why is everything a war? Its so fucking exhausting.
in reply to petsoi

Using json for IPC but a binary format for log files sounds insane to me, but alright.


Ebba Busch åkallar djävulen. Kristdemokraternas partiledare Ebba Busch med ett förflutet i evangeliska kristna kretsar besökte ett bröllop fullt med med fascister och nazister. Jimmie Åkessons bröllop. Där poserade hon bland annat på en bild ihop med Marcus Öhrn, som är sångare i Åkessons band Bedårande barn. Han är bland annat dömd för narkotikabrott och grov rattfylla. Dessutom för sexuellt ofredande efter att antastat två tonårsflickor i en kö på Gröna Lund i Stockholm.

blog.zaramis.se/2024/09/29/ebb…

This entry was edited (1 year ago)


The CUPS explout is here: GitHub - RickdeJager/cupshax


I hope this goes without saying but please do not run this on machines you don't own.

The good news:

  • the exploit seems to require user action

The bad news:

  • Device Firewalls are ineffective against this
  • if someone created a malicious printer on a local network like a library they could create serious issues
  • it is hard to patch without breaking printing
  • it is very easy to create printers that look legit
  • even if you don't hit print the cups user agent can reveal lots of information. This may be blocked at the Firewall

TLDR: you should be careful hitting print

This entry was edited (1 year ago)

reshared this

in reply to Possibly linux

This entry was edited (1 year ago)
in reply to tetris11

From what I understand, this allows arbitrary command execution. So, an attacker can specify a string of text that something on the affected system will just plop into a command line and execute.
in reply to Possibly linux

Not true, Arch and Ubuntu (the ones I personally checked on) already pushed patches that disabled cups browsed by default, removing the service listening on 631.


Discover RSS-Parrot: Your Fediverse-Friendly RSS Reader


in reply to Matt

Always happy to see more RSS-related tools emerge!
in reply to Matt



GE-Proton9-15 Released


Hotfix build:

Proton:

  • Updated wine to latest bleeding edge -- fixes regression in video playback from 9-14
  • Updated dxvk to latest git -- fixes regression which causes black textures and stuttering on NVIDIA cards.
  • Updated vkd3d-proton to latest git
  • import upstream changes for lsteamclient
  • update xalia to 0.4.4

Protonfixes:

  • Remove deprecated workaround for Total War Rome 2


Drinking 3 cups of coffee linked to preventing multiple diseases


WASHINGTON — A new study suggests that your morning brew might be doing more than just perking you up — it could be protecting you from a range of serious heart conditions. Researchers working with the Endocrine Society have found that drinking a moderate amount of coffee is associated with a lower risk of developing multiple cardiometabolic diseases. In simpler terms, your daily cup of coffee (or three) might help ward off conditions like Type 2 diabetes, heart disease, and stroke.

“Consuming three cups of coffee, or 200-300 mg caffeine, per day might help to reduce the risk of developing cardiometabolic multimorbidity in individuals without any cardiometabolic disease,” says Dr. Chaofu Ke, the lead author of the study from Suzhou Medical College in China, in a media release.


Source: studyfinds.org/3-cups-of-coffe…

in reply to W4nd3r3r

Also makes you awake for most of the nights.
This entry was edited (1 year ago)
in reply to W4nd3r3r

...what kind of cup? Does a Crema + double Espresso count as one or as three?