Possible Linux Severe CVSS 9.9/10 Unauthenticated RCE Flaw - GNU/Linuxcels: make sure to keep your systems up to date

  • 🐕 I am attempting to get the site runnning as fast as possible. If you are experiencing slow page load times, please report it.
Either this is a nothing burger or we're all sons of bitches. Guess we'll just have to wait and see
I assume it's a nothingburger.

If he tagged FreeBSD for a valid reason and not just his manic breakdown it's gotta be cups or sshd or one of those ancient unix things like rlogind which are known to be insecure anyway.
 
is there an alternative to printing on Linux or is CUPS the only thing?
Outside of ancient (see lpd) and esoteric (sending postscript files directly to postscript printers, sending emails to printers that are so enabled, or plugging a jumpdrive into a given printer because fuck networking), basically no. Even Samba which does the Windows server message block printer sharing shit really just uses CUPS under the hood. It feels kind of surprising that I've never seen an alternative, given that shit like SSHD has at least 3 variants (openssh, dropbear, busybox) that I can immediately think of off hand.
 
It's fucking NOTHING. Who the FUCK thought this was a 9.9 CVE? Heartbleed was fucking 7.5. What the actual fuck. Good lord. Absolutely no surprise that CUPS is a giant pile of shit. The bigger question is what kind of retard has CUPS exposed to the open internet?
This dude is a straight up retard.

A VULNERABILITY THAT AFFECTS EVERY LINUX SYSTEM except, like, let's look at the RHEL documentation

1727386383486.png


Oh, huh.
 
sudo pacman -R cups lib32-cups
error: target not found: cups
error: target not found: lib32-cups

Whew, so glad im not stuck in the 2000s still using overpriced chink printers. Whoever gave this a 9.9 CVE is a troon and needs to be fired, and if your server has cups enabled for whatever reasons and is connected to internet without some kind or firewall you are a jeet and need to be fired.
 
Has anyone confirmed the actual RCE yet? I hate shit like this. Only thing he was missing is some retarded domain name + logo for it. Maybe after this they'll make some t-shirts so we can remember this critical CVE.

I'm guessing SSH related if its "every linux system".
 
The bigger question is what kind of retard has CUPS exposed to the open internet?
There is (what appears to be) industrial equipment with a remote desktop exposed to the public internet. You can check for yourself on e.g. Shodan
A while ago I had a script that scraped that exact query for pictures. Here are some:
1.2.136.76.jpg106.249.250.226.jpg109.135.16.96.jpg113.161.239.87.jpg
Also some gamers:
220.79.65.104.jpg
and, uh:
88.0.8.166.jpg
I also connected to some to see if they were legit and it seems like they were.
It could be fake of course, but I'd rather not find out so I avoided touching any buttons.

Either way, there's plenty of retardation when it comes to basic security.
 

It's fucking NOTHING. Who the FUCK thought this was a 9.9 CVE? Heartbleed was fucking 7.5. What the actual fuck. Good lord. Absolutely no surprise that CUPS is a giant pile of shit. The bigger question is what kind of retard has CUPS exposed to the open internet?
I actually still remember heartbleed, people were making PSA's to update their information some decade ago.
 
Before any Windows/Apple users come by and drop the expected:

"Well well well, who's got the secure OS now?"
-:smug:

This affects you as well. 95% of webservers run on Linux. Linux is everywhere on the backend. If you see your IT guy stressed out at work, buy him a coffee.
Apple uses a forked version of CUPS. Does it affect them too?
 
Back