Hallo Christoph

Suse provides a CVE database on the one hand and the SUSE Update Advisories on the other. www.suse.com/.../ . In this database you can find information about Cup's CVE. www.suse.com/.../ patches seem to be available already.

One more thing about Heise. I have been working in the field of IT emergency management and preventive IT forensics for many years and have sometimes wondered about a security article from Heise because it did not describe a CVE 100% correctly. Please this is a personal opinion and as always, if I write nonsense please forgive me

George

First thing, make sure port 631 is not visible on the wild of the internet. That is just asking for trouble, even without this particular issue.

The Internet Storm Center (SANS) has a useful report pointing the CVEs involved, as well as some advice, especially "Don't Panic"

I'm seeing way too many devices with the port live to some extent (with NMAP) at one client, so I have a bunch of things to check out.

An example of the command (change your IP range as appropriate) to help see your base exposure.  (why are those systems accepting printing requests?)
  nmap -p 631 10.0.0.0/16

nmap comes with most linux systems by default. A GUI interface for most operating systems is called Zenmap.

Of the OES boxes just checked, only one of the CVEs appears exposed CVE-2024-47177, the other daemons aren't installed, even on the iPrint boxes.

Hi Andy,

Just imagine you are on a university campus with more than 1,000,000 million IPs. How many poorly secured systems will you find and how many ports listening on 631 in the campus network? How many public IPS and networks will you find on a campus network that will also offer 631.

II know I'm a ......;-)

Hi Georg, 

I was imagining those as well (and shudder). Let's just hope the patches at least become available before the breaches start happening (if it hasn't already happened)

Yes we both like 'stirring the pot'