CVE-2024-47175: libppd's ppdCreatePPDFromIPP2 function does not sanitize IPP attributes when creating the PPD buffer
A remote attacker who has successfully installed or hijacked an exposed printer (via UPD or mDNS) and was able to return a malicious IPP attribute, the attacker may be able to exploit FoomaticRIPCommandLine to execute arbitrary commands. Due to a lack of sanitization in cfGetPrinterAttributes API and ppdCreatePPDFromIPP2, a vulnerable CUPS system will execute the foomatic-rip filter binary when a print job is sent to the printer.
Other sources
CUPS is a standards-based, open-source printing system, and libppd can be used for legacy PPD file support. The libppd function ppdCreatePPDFromIPP2 does not sanitize IPP attributes when creating the PPD buffer. When used in combination with other functions such as cfGetPrinterAttributes5, can result in user controlled input and ultimately code execution via Foomatic. This vulnerability can be part of an exploit chain leading to remote code execution (RCE), as described in CVE-2024-47176.
— NVD
OpenPrinting libppd could allow a remote attacker to execute arbitrary command on the system, caused by the failure to validate or sanitize the IPP attributes when writing them to a temporary PPD file by the ppdCreatePPDFromIPP2 function in libppd. By sending a specially crafted request using IPP attribute, an attacker could exploit this vulnerability to execute arbitrary commands on the system.
— IBM
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-47175?
CVE-2024-47175 has a high severity rating due to its potential for remote code execution by an attacker.
How do I fix CVE-2024-47175?
To fix CVE-2024-47175, upgrade to the patched versions of CUPS and libppd as specified in the advisory.
What systems are affected by CVE-2024-47175?
CVE-2024-47175 affects Debian packages of CUPS versions up to 2.3.3op2-3+deb11u8 and specific versions of libppd.
Can a remote attacker exploit CVE-2024-47175 without access to the network?
Yes, a remote attacker can exploit CVE-2024-47175 through exposed network interfaces like UPD or mDNS.
What types of commands can be executed due to CVE-2024-47175?
CVE-2024-47175 allows attackers to execute arbitrary commands through FoomaticRIPCommandLine.