There’s been talk of this unauthenticated RCE vulnerability coming with a CVSS 9.9 rating but none of the technical details were publicly known until it was made public just now at the top of the hour. Simone Margaritelli discovered this vulnerability and has shared a write-up around this potentially very impactful Linux vulnerability.
This vulnerability, fortunately, doesn’t affect the Linux kernel but rather CUPS… The print server commonly used on Linux systems and other platforms.
…
From Attacking UNIX Systems via CUPS, Part I:
“A remote unauthenticated attacker can silently replace existing printers’ (or install new ones) IPP urls with a malicious one, resulting in arbitrary command execution (on the computer) when a print job is started (from that computer).”
…
This remote code execution issue can be exploited across the public Internet via a UDP packet to port 631 without needing any authentication, assuming the CUPS port is open through your router/firewall. LAN attacks are also possible via spoofing zeroconf / mDNS / DNS-SD advertisements.
Besides CUPS being used on Linux distributions, it also affects some BSDs, Oracle Solaris, Google Chrome OS, and others.
As of writing there is no Linux fix available for this high profile security issue. In the meantime it’s recommended to disable and remove the “cups-browsed” service, updating CUPS, or at least blocking all traffic to UDP port 631.
My router will still block all ports not explicitly allowed for the hosts regardless of protocol, it’s a firewall after all and not just NAT. Just because the host addressable doesn’t mean its ports are reachable.
Unfortunately many of the routers provided by ISPs I have seen where not configured that way by default. They only used NAT as firewall, so without configured port forwarding nothing could be reached with IPv4. But for IPv6: If you know the IPv6 for any system on the local network it is free available on all ports. It is the first thing I check when someone asks me to check their network or configure their internet, and only Fritz!Box have a sane default for IPv6 (but to be honest my other experiences are mostly with shitty Vodafone and german Telekom routers so it is a very limited set, and I really hope that most others are better.)