Security cups-browsed

[shep]

I'm not sure it impacts this community as much with the LPD print spooler provided in base BSD installs. For BSD users using cups, cups-browsed needed to be manually enabled.
Cups will run without cups-browsed but will not "discover" printers on the LAN.

I have a Debian system for CAD and the quick mitigation is to
# systemctl stop cups-browsed && systemctl disable cups-browsed
For BSD users, just stop/disable cups-browsed in rc.conf/rc.conf.local.

More details here:
https://www.redhat.com/en/blog/red-h...ulnerabilities

[Head_on_a_Stick]

Full write up of the vulnerability here (well, part one anyway):

https://www.evilsocket.net/2024/09/2...a-CUPS-Part-I/

[frcc]

Who would have "thunk it"

[jmccue]

From what I see, cups-browsed does not exist on my setup of NetBSD and OpenBSD.

On OpenBSD 7.5 amd64 I did a

pkg_info -f cups-browsed  | grep depend

and seems it is only needed by

• net/avahi
• print/libppd

Some cups files were pulled in on those systems, probably by Firefox.

That assumes I used the correct command

[shep]

I looked at the PLiSTs for FreeBSD, OpenBSD and NetBSD. It looks like AVAHI is enabled in the default FreeBSD package only.

freshports /print/cups/

Correction: cups-browsed is a run depends in OpenBSD and should get installed by default. It still needs to be manually enabled.
https://marc.info/?l=openbsd-ports&m...5032602925&w=2

[shep]

@jmccue

pkg_info, without flags, shows the names and one-line comment for installed packages.

I use
$ pkg_info | grep cups-browsed