[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-id: <175c118b-0771-425c-bc9d-d7da8ec5f40b@me.com>
Date: Thu, 3 Oct 2024 17:54:15 +0000 (UTC)
From: Larry Cashdollar <larry0@...com>
To: oss-security@...ts.openwall.com
Subject: cups-browsed vulnerable to DDoS amplification attack
Hello, oss-security, So while reading Evilsocket's blog post I noticed an attack vector that was not discussed DDoS. The problem arises when an attacker sends a crafted packet specifying the address of a target as a printer to be added. For each packet sent, the vulnerable CUPS server will generate a larger and partially attacker-controlled IPP/HTTP request directed at the specified target. As a result, not only is the target affected, but the host of the CUPS server also becomes a victim, as the attack consumes its network bandwidth and CPU resources. A simple script can be used to send the malicious UDP packet to a vulnerable instance of CUPS. The crafted payload directs CUPS to send an IPP/HTTP request to the target and port specified by the attacker. The vulnerability appears when cups-browsed attempts to fetch the URI specified to download the IPP attributes file. This PPD file URI is somewhat arbitrary and can be modified by the attacker. In testing, we found this URI payload can be padded out to 989 bytes. This padding will be included twice in the IPP/HTTP request: once in the HTTP headers, and again in the POST data that will be directed at the targeted system. By using this padding technique, attackers could further exacerbate the impact of CUPS-supported DDoS attacks by consuming additional bandwidth and resources on the targeted networks and systems. The attacking system only needs to send a single packet to a vulnerable and exposed CUPS service with internet connectivity to cause the system running CUPS to begin the attack. It seems updating to the latest cups version mitigates this issue for most linux systems. I've requested a CVE ID to be able to discern between the RCE and the DoS vulnerability. Attack requests appear like the following in server logs: x.x.x.x- - [03/Oct/2024:09:58:01 +0000] "POST /printers/ HTTP/1.1" 404 462 "-" "CUPS/2.4.2 (Linux 6.1.0-25-amd64; x86_64) IPP/2.0" Or x.x.x.x - - [03/Oct/2024:09:58:01 +0000] "POST /classes/ HTTP/1.1" 404 462 "-" "CUPS/2.4.2 (Linux 6.1.0-25-amd64; x86_64) IPP/2.0" Additional details can be found here: https://www.akamai.com/blog/security-research/october-cups-ddos-threat Thanks, Larry Cashdollar
Content of type "text/html" skipped
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
