CVE-2024-47076: Informational: No Impact of CUPS Vulnerabilities on Palo Alto Networks Products (Severity: NONE)

If an attacker is able to exploit an exposed IPP server to respond with a valid response to be added to the system, and if discovered via mDNS, an existing printer can be directly hijacked (its IPP url replaced with a malicious one) making it indistinguishable from the original one. The cfGetPrinterAttributes API does not perform any sanitization on any of the IPP attributes returned by the server. Attributes that are then saved, as they are, in a temporary PPD file via ppdCreatePPDFromIPP2. ppdCreatePPDFromIPP2 doesn't perform any sanitization itself and in fact it just writes to the file any attributes contents. This allows an attacker to return a malicious IPP attribute in the form of printer-privacy-policy-uri (which is just one of the several attributes that can be used, the RCE was also confirmed with printer-info, printer-name and printer-make-and-model).

— Red Hat

OpenPrinting ibcupsfilters could allow a remote attacker to bypass security restrictions, caused by the failure to validate or sanitize the IPP attributes returned from an IPP server by the libcupsfilters component. By replacing the valid IPP URL with a malicious one, an attacker could exploit this vulnerability to add a malicious printer or directly hijack an existing printer.

— IBM

The Palo Alto Networks Product Security Assurance team has evaluated CVE-2024-47076, CVE-2024-47177, CVE-2024-47175, and CVE-2024-47176 in the Common UNIX Printing System (CUPS) as they relate to our products.

Based on current information, Palo Alto Networks products and cloud services do not contain affected CUPS-related software packages and are not impacted by these issues.

— Palo Alto Networks

This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.

— Launchpad