MX Linux Forum

Eadwine Rose wrote: Thu Sep 26, 2024 1:52 am Did they finally find the one responsible for all the PEBKAC issues?

• September 30: Initial disclosure to the Openwall security mailing list.
  October 6: Full public disclosure of the vulnerability details

And YES: I LOVE hyping the sh1t out of this stuff because apparently sensationalism is the only language that forces these people to fix.

Eadwine Rose wrote: Thu Sep 26, 2024 1:52 am Did they finally find the one responsible for all the PEBKAC issues?

j2mcgreg wrote: Thu Sep 26, 2024 7:31 am The boy who cried wolf has more credibility than Bryan Lunduke.

DukeComposed wrote: Thu Sep 26, 2024 12:56 pm

Eadwine Rose wrote: Thu Sep 26, 2024 1:52 am Did they finally find the one responsible for all the PEBKAC issues?

Alan Cox hasn't been involved in the project in years.

Mauser wrote: Wed Sep 25, 2024 11:02 pm Lunduke video on Severe (9.9 / 10) Linux Vulnerability Announced, Details Kept Secret. Hopefully this is not real. https://www.youtube.com/watch?v=8PbTZaWFzf8

siamhie wrote: Thu Sep 26, 2024 9:48 am Remember that apparently this flaw has been around for 10 years and we don't even know what is affected? Could this also affect *BSD systems (CUPS is thrown around in the comments on Slashdot)?

kernelkurtz wrote: Thu Sep 26, 2024 10:07 pm he has in the last few years become more extremist and reactionary than he's ever been in the past

This gets said by more and more people, about more and more people.

I will just point out that there is a valid alternative explanation. Which is that people don't change all that much, but the culture has shifted dramatically to 'the center' under their feet, leaving them looking extremist for views they've always held and the actions they take as a result.

Eadwine Rose wrote: Sat Sep 28, 2024 5:10 am Still able to print in all ways?

Eadwine Rose wrote: Thu Sep 26, 2024 1:27 pmTo be honest, I don't care about this sort of stuff on who did what and when. You use the computer, you are responsible.

Details Kept Secret

The most important detail is: the Debian CUPS patches are being distributed by the MX Updater by now.
Received them on my MX 21.3 only a few minutes ago.

entropyfoe wrote: Sun Sep 29, 2024 6:25 pm carlchen wrote

The most important detail is: the Debian CUPS patches are being distributed by the MX Updater by now.
Received them on my MX 21.3 only a few minutes ago.

Thanks to the dev and packaging team, and up stream at Debian.

Thanks for the swift action.

CharlesV wrote: Thu Sep 26, 2024 8:35 pm Another short read on the issue
https://www.phoronix.com/news/Linux-CVSS-9.9-Rating

This remote code execution issue can be exploited across the public Internet via a UDP packet to port 631 without needing any authentication, assuming the CUPS port is open through your router/firewall. LAN attacks are also possible via spoofing zeroconf / mDNS / DNS-SD advertisements.

Besides CUPS being used on Linux distributions, it also affects some BSDs, Oracle Solaris, Google Chrome OS, and others.

As of writing there is no Linux fix available for this high profile security issue. In the meantime it's recommended to disable and remove the "cups-browsed" service, updating CUPS, or at least blocking all traffic to UDP port 631.

dreamer wrote: Sat Sep 28, 2024 6:53 am The severe vulnerability 9.9/10 doesn’t impact basic printing and scanning.

The easiest solution is to uninstall the cups-browsed package. I always do this on my personal snapshots. It doesn’t affect printing or scanning. If you don’t want to uninstall the cups-browsed package you can disable the service while you wait for patches to be delivered.

Red Hat has a good write-up:
https://www.redhat.com/en/blog/red-hat- ... rabilities

Mitigation of these vulnerabilities is as simple as running two commands, especially in any environment where printing is not needed.

But, yes, it looks like blocking UDP port 631 will be the best stop for this.

joekamprad @EOS forum wrote:

Code: Select all

systemctl status cups-browsed 

to check if you have it enabled

Code: Select all

sudo systemctl disable --now cups-browsed

to stop/disable.

status cups-browsed.service

sudo disable cups-browsed.service

LinuxSpring1 wrote: Mon Sep 30, 2024 12:41 am So if the service cups-browsed is disabled or the package is uninstalled then will not the printing and scanning be impacted? Because the RedHat article refers to the case where printing is not needed. Many of us are using Desktops and there printing and scanning is required.

mxethernut wrote: Mon Sep 30, 2024 5:18 amDo you have ufw/gufw installed and running as a service? You can close port 631 with this firewall.

Code: Select all

ufw deny 631/tcp

sudo ufw enable

mxethernut wrote: Mon Sep 30, 2024 5:18 am @operadude: Looks like you do not want to disable the system.d cups-browsed service because you need your printers:

joekamprad @EOS forum wrote:

Code: Select all

systemctl status cups-browsed 

to check if you have it enabled

Code: Select all

sudo systemctl disable --now cups-browsed

to stop/disable.

Is it

Code: Select all

status cups-browsed.service

and

Code: Select all

sudo disable cups-browsed.service

on Sysvinit? (Not using it b/c of sound issues)


Do you have ufw/gufw installed and running as a service? You can close port 631 with this firewall. It will protect this and all other ports by default.

ufw deny 631/tcp >> Please check https://docs.e2enetworks.com/guides/ufw.html, this is for system.d however.

$ systemctl status cups-browsed
System has not been booted with systemd as init system (PID 1). Can't operate.
Failed to connect to bus: Host is down

$ systemctl status cups-browsed.service
System has not been booted with systemd as init system (PID 1). Can't operate.
Failed to connect to bus: Host is down

Do you have ufw/gufw installed and running as a service? You can close port 631 with this firewall. It will protect this and all other ports by default.

$ sudo ufw status
[sudo] password for opera-dude:            
Status: active

karlchen wrote: Mon Sep 30, 2024 5:59 am Hell, mxethernut-

mxethernut wrote: Mon Sep 30, 2024 5:18 amDo you have ufw/gufw installed and running as a service? You can close port 631 with this firewall.

Code: Select all

ufw deny 631/tcp

Closing TCP port 631 is closing the CUPS port. I suspect this will prevent you from printing completely.

In order to prevent connecting to cups-browsed from outside you have to close UDP port 631.

In the most simple scenario you simply switch on ufw by executing

Code: Select all

sudo ufw enable

This will tell the MX software firewall to reject any incoming connection requests, including UDP port 631.

Karl

mxethernut wrote: Sun Sep 29, 2024 1:41 pm Thank you MX/Debian for getting updates out quickly!

Start-Date: 2024-09-30  01:10:34
Commandline: apt dist-upgrade
Requested-By: aika (1000)
Upgrade: libcups2:amd64 (2.3.3op2-3+deb11u8, 2.3.3op2-3+deb11u9), cups-filters:amd64 (1.28.7-1+deb11u2, 1.28.7-1+deb11u3), cups-bsd:amd64 (2.3.3op2-3+deb11u8, 2.3.3op2-3+deb11u9), cups-common:amd64 (2.3.3op2-3+deb11u8, 2.3.3op2-3+deb11u9), cups-client:amd64 (2.3.3op2-3+deb11u8, 2.3.3op2-3+deb11u9), cups-ppdc:amd64 (2.3.3op2-3+deb11u8, 2.3.3op2-3+deb11u9), cups-daemon:amd64 (2.3.3op2-3+deb11u8, 2.3.3op2-3+deb11u9), libfontembed1:amd64 (1.28.7-1+deb11u2, 1.28.7-1+deb11u3), cups-filters-core-drivers:amd64 (1.28.7-1+deb11u2, 1.28.7-1+deb11u3), cups-ipp-utils:amd64 (2.3.3op2-3+deb11u8, 2.3.3op2-3+deb11u9), cups-browsed:amd64 (1.28.7-1+deb11u2, 1.28.7-1+deb11u3), cups-core-drivers:amd64 (2.3.3op2-3+deb11u8, 2.3.3op2-3+deb11u9), cups:amd64 (2.3.3op2-3+deb11u8, 2.3.3op2-3+deb11u9), cups-server-common:amd64 (2.3.3op2-3+deb11u8, 2.3.3op2-3+deb11u9), libcupsfilters1:amd64 (1.28.7-1+deb11u2, 1.28.7-1+deb11u3)
End-Date: 2024-09-30  01:11:20

sudo ufw status verbose
[sudo] Passwort für aika: 
Status: active
Logging: on (low)
Default: deny (incoming), allow (outgoing), disabled (routed)
New profiles: skip

To                         Action      From
--                         ------      ----
5060/udp                   ALLOW IN    Anywhere                  
1720/tcp                   ALLOW IN    Anywhere                  
39275/udp                  ALLOW IN    Anywhere
...

Feeling better that I have "ufw" enabled (I think it's the default now)

operadude wrote: Mon Sep 30, 2024 7:44 am
Thanks for the command snippets, but I am using sysVinit, and thus no "systctl":


Assuming for now that I'm OK.

status cups-browsed

status cups-browsed.service

operadude wrote: Mon Sep 30, 2024 4:10 am

But, yes, it looks like blocking UDP port 631 will be the best stop for this.

@CharlesV Silly(?) Question:

I am not (to the best of my knowledge) in a hostile environment, and I occasionally use port 631 (localhost) to login, via my password-protected router, into "CUPS", so as to maintain and/or change my printers (drivers, names, etc), that are all (Network) shared on my Local Network (router).

Given all of the previous comments, should I NOT be using port 631?

I do not know of any other way to login to CUPS.

Oh...I'm not sure if I'm using UDP, or some other protocol. I guess I'm using whatever the defaults are for all MX distros (KDE, Fluxbox, Xfce)-- I use all of them.

Awaiting precious explication...

karlchen wrote: Mon Sep 30, 2024 5:50 am Hello, LinuxSpring1.

LinuxSpring1 wrote: Mon Sep 30, 2024 12:41 am So if the service cups-browsed is disabled or the package is uninstalled then will not the printing and scanning be impacted? Because the RedHat article refers to the case where printing is not needed. Many of us are using Desktops and there printing and scanning is required.

The answer to this question is: well, it depends.

In case your network MFP printer has been added to your system through cups-browsed only, then switching off cup-browsed will indeed make the device disappear from the system again. So, the answer in this case would be: yes.

In case, however, your network MFP device has been set up manually e.g. through HPLIP like my HP Color Laserjet Pro MFP M277dw, then during this setup the MFP's IP address has been added to the relevant configuration files. As a consequence the system will not depend on cups-browsed in order to connect to the MFP. Printing and scanning will work without cups-browsed.

Note:
HPLIP is only used for HP printers and scanners. For printers of other producers you will have to install their appropriate driver software instead.

Hope my explanation was not too confusing.

Karl