cups-browsed vulnerable to DDoS amplification attack

[Larry Cashdollar <larry0 () me com>]

Hello, oss-security, So while reading Evilsocket's blog post I noticed an attack vector that was not discussed DDoS. The problem arises when an attacker sends a crafted packet 
specifying the address of a target as a printer to be added. For each packet sent, the vulnerable CUPS server will generate a larger and partially attacker-controlled IPP/HTTP request 
directed at the specified target. As a result, not only is the target affected, but the host of the CUPS server also becomes a victim, as the attack consumes its network bandwidth and CPU 
resources. A simple script can be used to send the malicious UDP packet to a vulnerable instance of CUPS. The crafted payload directs CUPS to send an IPP/HTTP request to the target and port 
specified by the attacker. The vulnerability appears when cups-browsed attempts to fetch the URI specified to download the IPP attributes file. This PPD file URI is somewhat arbitrary and 
can be modified by the attacker. In testing, we found this URI payload can be padded out to 989 bytes. This padding will be included twice in the IPP/HTTP request: once in the HTTP headers, 
and again in the POST data that will be directed at the targeted system. By using this padding technique, attackers could further exacerbate the impact of CUPS-supported DDoS attacks by 
consuming additional bandwidth and resources on the targeted networks and systems. The attacking system only needs to send a single packet to a vulnerable and exposed CUPS service with 
internet connectivity to cause the system running CUPS to begin the attack. It seems updating to the latest cups version mitigates this issue for most linux systems. I've requested a 
CVE ID to be able to discern between the RCE and the DoS vulnerability. Attack requests appear like the following in server logs: x.x.x.x- - [03/Oct/2024:09:58:01 +0000] "POST 
/printers/ HTTP/1.1" 404 462 "-" "CUPS/2.4.2 (Linux 6.1.0-25-amd64; x86_64) IPP/2.0" Or x.x.x.x - - [03/Oct/2024:09:58:01 +0000] "POST /classes/ HTTP/1.1" 
404 462 "-" "CUPS/2.4.2 (Linux 6.1.0-25-amd64; x86_64) IPP/2.0" Additional details can be found here: 
https://www.akamai.com/blog/security-research/october-cups-ddos-threat Thanks, Larry Cashdollar