libppd: CUPS libppd improper input validation (CVE-2024-47175) #shorts #breaking

CVE

This security vulnerability involves the CUPS printing system, specifically the libppd library. An issue in the libppd function called ppdCreatePPDFromIPP2 fails to properly validate input attributes from IPP, leading to potential remote code execution. This vulnerability can be exploited through a chain involving Foomatic, allowing malicious actors to control input and execute arbitrary code. It affects all versions of libppd up to and including version 2.1b1. The vulnerability, identified as CVE-2024-47175, is a zero-day, meaning it is actively exploited, yet less than a month old, with no specific targets currently known.

This chain involves the following actors

This following systems are involved

Attack entry point

Remediation actions

Exploitation actions

• https://github.com/OpenPrinting/libppd/security/advisories/GHSA-7xfx-47qg-grp6
• https://github.com/OpenPrinting/cups-browsed/security/advisories/GHSA-rj88-6mr5-rcw8
• https://github.com/OpenPrinting/cups-filters/security/advisories/GHSA-p9rh-jxmq-gq47
• https://github.com/OpenPrinting/libcupsfilters/security/advisories/GHSA-w63j-6g73-wmg5
• https://www.cups.org
• https://www.evilsocket.net/2024/09/26/Attacking-UNIX-systems-via-CUPS-Part-I