Skip to content

Commit

Permalink
Default BrowseRemoteProtocols should not include "cups" protocol
Browse files Browse the repository at this point in the history 
Works around CVE-2024-47176, the fix will be complete removal of CUPS
Browsing functionality
  • Loading branch information
@zdohnal
zdohnal committed Sep 26, 2024
1 parent c12b9cf commit 1debe6b
Showing 1 changed file with 2 additions and 2 deletions.
4 changes: 2 additions & 2 deletions configure.ac
View file
Original file line number Diff line number Diff line change
Expand Up @@ -183,9 +183,9 @@ else
fi

AC_ARG_WITH([browseremoteprotocols],
[AS_HELP_STRING([--with-browseremoteprotocols=value], [Set which protocols to listen for in cups-browsed (default: dnssd cups)])],
[AS_HELP_STRING([--with-browseremoteprotocols=value], [Set which protocols to listen for in cups-browsed (default: dnssd)])],
[with_browseremoteprotocols="$withval"],
[with_browseremoteprotocols="dnssd cups"]
[with_browseremoteprotocols="dnssd"]
)
BROWSEREMOTEPROTOCOLS="$with_browseremoteprotocols"
AC_SUBST(BROWSEREMOTEPROTOCOLS)
Expand Down

2 comments on commit 1debe6b

@jsmeix
Copy link

@jsmeix jsmeix commented on 1debe6b Sep 30, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@zdohnal
only a question out of curiosity:

I did not yet try out how things behave with the patch
but from plain looking what the patch changes
I think it does not actually improve that cups-browsed
blindly trusts any incoming packet from any host at UDP port 631
but instead it disables by default listening on UDP port 631.
Do I understand it right?

If yes, then I think it avoids the CVE only when cups-browsed
is run with the new default setting which may not happen
after a RPM package update with a new /etc/cups/cups-browsed.conf
when the user had changed his existing /etc/cups/cups-browsed.conf
perhaps because of things like certain RPM config file handling?

@michaelrsweet
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@jsmeix You are correct, the current "fix" just disables CUPS browsing by default. Till still needs to rip out the LDAP and CUPS browsing code and do a new release of that...

Please sign in to comment.