![\"\"](\"https:\/\/www.deepin.org\/wp-content\/uploads\/2024\/10\/\u91cd\u78c5\u65b0\u95fb\u4e25\u8083\u79d1\u6280\u98ce\u6241\u5e73\u7b80\u7ea6\u516c\u4f17\u53f7\u9996\u56fe__2024-10-0814_02_29.png\")
<\/p>\nOn September 27, 2024, security researcher Simone \"evilsocket\" Margaritelli reported on his personal blog that the Unix-based printing framework CUPS has multiple high-risk security vulnerabilities[1]<\/sup>. Unauthenticated remote attackers can impersonate printers, using malicious IPP URLs to replace the URLs of existing printers or add new malicious printers. In this scenario, when a user initiates a print job from the affected computer, attackers can silently execute arbitrary commands on that computer through the fake printer URL, thereby achieving the attack.<\/p>\n These vulnerabilities have been confirmed by the upstream software maintainers and security personnel, and temporary measures have been taken to disable the relevant features to mitigate the risks. No functional fixes are currently provided.<\/p>\n Vulnerability IDs: CVE-2024-47176, CVE-2024-47076, CVE-2024-47175, CVE-2024-47177. [2][3][4]<\/sup><\/p>\n <\/p>\n 1\u3001If you have not installed cups-browsed (this package is not pre-installed in deepin 23), you are not affected by this vulnerability.<\/p>\n 2\u3001If you do not perform any printing operations, you will not trigger this vulnerability.<\/p>\n 3\u3001If you have installed cups-browsed and perform printing operations, you may be affected by this vulnerability.<\/p>\n <\/p>\n<\/section>\n<\/section>\n<\/section>\n 1\u3001If you do not need the cups-browsed service<\/strong>, stopping or uninstalling the cups-browsed service can mitigate attacks over the network:<\/p>\n a. b. <\/p>\n 2\u3001If you need the cups-browsed service,<\/strong> you can:<\/p>\n a. Enable the firewall to block UDP 631 port traffic to prevent attacks.<\/p>\n b. Edit\u00a0 \/etc\/cups\/cups-browsed.conf, search for the BrowseRemoteProtocols field, remove cups and execute <\/p>\n deepin 23 has patched cups-browsed and cups-filters on September 27, 2024. We strongly recommend that all users update immediately to fix this security vulnerability. The patched version is: 1.28.17-3.1~deepin3.<\/p>\n <\/p>\n (All times are Beijing Time)<\/p>\n <\/p>\n References:<\/strong><\/p>\n[1] Blog address: https:\/\/www.evilsocket.net\/2024\/09\/26\/Attacking-UNIX-systems-via-CUPS-Part-I\/<\/a><\/p>\n[2] Alibaba Cloud report: https:\/\/avd.aliyun.com\/detail?id=AVD-2024-47176<\/a><\/p>\n[3] JFrog report: https:\/\/jfrog.com\/blog\/cups-attack-zero-day-vulnerability-all-you-need-to-know\/<\/a><\/p>\n[4] oss-security report: https:\/\/www.openwall.com\/lists\/oss-security\/2024\/09\/26\/5<\/a><\/p>\n <\/p>\n <\/p>\n \uff081\uff09deepin Full Version Image Downloads (including deepin V15)<\/a><\/p>\n \uff082\uff09deepin en Espa\u00f1ol Community<\/a><\/p>\n \uff083\uff09Why is there no deepin 24<\/a><\/p>\n <\/p>\n Content source: deepin community<\/p>\n Reprinted with attribution<\/p>","protected":false},"excerpt":{"rendered":" On September 27, 2024, security researcher Simone \"evilsocket\" Margaritelli reported on his personal blog that the Unix-based printing framework CUPS has multiple high-risk security vulnerabilities[1]. Unauthenticated remote attackers can impersonate printers, using malicious IPP URLs to replace the URLs of existing printers or add new malicious printers. In this scenario, when a user initiates a print job from the affected computer, attackers can silently execute arbitrary commands on that computer through the fake printer URL, thereby achieving the attack. These vulnerabilities have been confirmed by the upstream software maintainers and security personnel, and temporary measures have been taken to disable ...Read more<\/a><\/p>\n","protected":false},"author":11164,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[93],"tags":[144,153,148,141,147,143],"_links":{"self":[{"href":"https:\/\/www.deepin.org.cn\/en\/wp-json\/wp\/v2\/posts\/34931"}],"collection":[{"href":"https:\/\/www.deepin.org.cn\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.deepin.org.cn\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.deepin.org.cn\/en\/wp-json\/wp\/v2\/users\/11164"}],"replies":[{"embeddable":true,"href":"https:\/\/www.deepin.org.cn\/en\/wp-json\/wp\/v2\/comments?post=34931"}],"version-history":[{"count":6,"href":"https:\/\/www.deepin.org.cn\/en\/wp-json\/wp\/v2\/posts\/34931\/revisions"}],"predecessor-version":[{"id":34939,"href":"https:\/\/www.deepin.org.cn\/en\/wp-json\/wp\/v2\/posts\/34931\/revisions\/34939"}],"wp:attachment":[{"href":"https:\/\/www.deepin.org.cn\/en\/wp-json\/wp\/v2\/media?parent=34931"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.deepin.org.cn\/en\/wp-json\/wp\/v2\/categories?post=34931"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.deepin.org.cn\/en\/wp-json\/wp\/v2\/tags?post=34931"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}Am I affected?<\/strong><\/h1>\n
Temporary protection measures<\/strong><\/h1>\n
sudo systemctl disable --now cups-browsed<\/code><\/p>\nsudo apt remove cups-browsed<\/code><\/p>\nsudo systemctl restart cups-browsed<\/code> to restart cups-browsed.<\/p>\ndeepin 23 Patch<\/strong><\/h1>\n
Event Timeline<\/strong><\/h1>\n
\n
Releated Reading\uff1a<\/strong><\/h1>\n