As Akamai security researchers found, a CVE-2024-47176 security flaw in the cups-browsed daemon that can be chained with three other bugs to gain remote code execution on Unix-like systems via a single UDP packet can also be leveraged to amplify DDoS attacks. Furthermore, hundreds of vulnerable devices demonstrated an "infinite loop" of requests, with some CUPS servers repeatedly sending requests after receiving an initial probe and some servers entering an endless loop in response to specific HTTP/404 errors. Admins are advised to deploy CVE-2024-47176 patches or disable the cups-browsed service from running to block potential attacks to mitigate the risk of having their servers added to a botnet or used in DDoS attacks. "DDoS continues to be a viable attack vector used to harass and disrupt victims across the internet, from major industries and governments to small content creators, online shops, and gamers," Akamai's researchers warned. As Cloudflare revealed this week, its DDoS defense systems had to protect customers against a wave of hyper-volumetric L3/4 DDoS attacks reaching 3.8 terabits per second (Tbps), the largest such attack ever recorded. To initiate such an attack, a malicious actor only needs to send a single packet to an exposed and vulnerable CUPS service exposed online. Akamai researchers estimate that around 58,000 servers, out of over 198,000 exposed devices, could be recruited for DDoS attacks. Many of these vulnerable machines were running outdated versions of CUPS (going as far back as 2007), which are easy targets for cybercriminals who can exploit them to build botnets via the RCE chain or use them for DDoS amplification. Each packet sent to vulnerable CUPS servers prompts them to generate larger IPP/HTTP requests aimed at the targeted device. A recently disclosed vulnerability in the Common Unix Printing System (CUPS) open-source printing system can be exploited by threat actors to launch distributed denial-of-service (DDoS) attacks with a 600x amplification factor. Akamai warns that a threat actor could easily take control of every exposed CUPS service on the internet in seconds.
This Cyber News was published on www.bleepingcomputer.com. Publication date: Thu, 03 Oct 2024 22:35:23 +0000