• 3 Posts
  • 467 Comments
Joined 1 year ago
cake
Cake day: June 9th, 2023

help-circle
  • CUPS is installed on the majority of desktop systems. One of the listed CVEs indicates that port 631 is by default open to the local network, so if you connect to any shared network (public WiFi, work/school network, even your home network if another compromised device gets connected to it) you’re exposed. Or a browser flaw or other vulnerability could be exploited to forward a packet to that port.

    In other words: While access to port 631 is required first, the severity of the vulnerability lies in how damn easy it is to take over a system after that. And the system can be re-compromised any time you print something, making this a persistent vector.


















  • That seems like a myopic view. Service misconfiguration is not always a vendor’s fault, and demanding software vendors to patch their products is not going to fix OSS vulnerabilities. In fact, we’ve seen examples this year of increased pressure to fix “issues” leading to developers unwittingly accepting malicious commits.

    Mind you, I’m not contesting that some vendors produce dogshit products (looking at you, CrowdStrike), but calling all vendors villains is a bit of a stretch.