Detections
Analytics

Alpine: ipptool, multiple cups packages: security update to 2.4.9-r0

medium Tenable Cloud Security Plugin ID 423786

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In
 versions 2.4.8 and earlier, when starting the cupsd server with a Listen configuration item pointing to a
 symbolic link, the cupsd process can be caused to perform an arbitrary chmod of the provided argument,
 providing world-writable access to the target. Given that cupsd is often running as root, this can result
 in the change of permission of any user or system files to be world writable. Given the aforementioned
 Ubuntu AppArmor context, on such systems this vulnerability is limited to those files modifiable by the
 cupsd process. In that specific case it was found to be possible to turn the configuration of the Listen
 argument into full control over the cupsd.conf and cups-files.conf configuration files. By later setting
 the User and Group arguments in cups-files.conf, and printing with a printer configured by PPD with a
 `FoomaticRIPCommandLine` argument, arbitrary user and group (not root) command execution could be
 achieved, which can further be used on Ubuntu systems to achieve full root command execution. Commit
 ff1f8a623e090dee8a8aadf12a6a4b25efac143d contains a patch for the issue. (CVE-2024-35235)

See Also

https://security.alpinelinux.org/vuln/CVE-2024-35235

Plugin Details

Severity: Medium

ID: 423786

Version: Revision 1.9

Type: Local

Published: 4/4/2025

Updated: 7/2/2026

Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: High

Score: 7.6

Percentile: 98.54

CVSS v2

Risk Factor: Medium

Base Score: 6.5

Temporal Score: 5.1

Vector: CVSS2#AV:L/AC:L/Au:M/C:C/I:C/A:C

CVSS Score Source: CVE-2024-35235

CVSS v3

Risk Factor: Medium

Base Score: 6.7

Temporal Score: 6

Vector: CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Vulnerability Publication Date: 6/11/2024

Reference Information

CVE: CVE-2024-35235