Hello, oss-security, So while reading Evilsocket's blog post I noticed an attack vector that was not discussed DDoS. The problem arises
when an attacker sends a crafted packet specifying the address of a target as a printer to be added. For each packet sent, the vulnerable
CUPS server will generate a larger and partially attacker-controlled IPP/HTTP request directed at the specified target. As a result, not
only is the target affected, but the host of the CUPS server also becomes a victim, as the attack consumes its network bandwidth and CPU
resources. A simple script can be used to send the malicious UDP packet to a vulnerable instance of CUPS. The crafted payload directs CUPS
to send an IPP/HTTP request to the target and port specified by the attacker. The vulnerability appears when cups-browsed attempts to fetch
the URI specified to download the IPP attributes file. This PPD file URI is somewhat arbitrary and can be modified by the attacker. In
testing, we found this URI payload can be padded out to 989 bytes. This padding will be included twice in the IPP/HTTP request: once in the
HTTP headers, and again in the POST data that will be directed at the targeted system. By using this padding technique, attackers could
further exacerbate the impact of CUPS-supported DDoS attacks by consuming additional bandwidth and resources on the targeted networks and
systems. The attacking system only needs to send a single packet to a vulnerable and exposed CUPS service with internet connectivity to
cause the system running CUPS to begin the attack. It seems updating to the latest cups version mitigates this issue for most linux
systems. I've requested a CVE ID to be able to discern between the RCE and the DoS vulnerability. Attack requests appear like the following
in server logs: x.x.x.x- - [03/Oct/2024:09:58:01 +0000] "POST /printers/ HTTP/1.1" 404 462 "-" "CUPS/2.4.2 (Linux
6.1.0-25-amd64; x86_64) IPP/2.0" Or x.x.x.x - - [03/Oct/2024:09:58:01 +0000] "POST /classes/ HTTP/1.1" 404 462 "-"
"CUPS/2.4.2 (Linux 6.1.0-25-amd64; x86_64) IPP/2.0" Additional details can be found here:
https://www.akamai.com/blog/security-research/october-cups-ddos-threat Thanks, Larry Cashdollar
