CVE-2014-2707

What it actually does

Allows remote IPP printers to inject arbitrary shell commands via metacharacters in model or PDL fields that are passed into generated System V interface scripts.

Why it matters to the business

Enables remote code execution on Linux systems exposing printing services, risking full host compromise, data access, or lateral movement; low urgency given age and absence of known exploitation campaigns.

How an attack unfolds

Attacker advertises a malicious IPP printer containing shell metacharacters in model or PDL; cups-browsed processes the advertisement, creates a print queue, and executes the injected commands when generating interface scripts.

How to fix it

Upgrade cups-filters to version 1.0.51 or later; disable cups-browsed if automatic printer discovery is not required.

How to confirm the fix worked

Confirm cups-filters version is 1.0.51 or higher; test by submitting an IPP advertisement with metacharacters in model field and verify no command execution occurs.

Typical attack path

1. Broadcast crafted IPP printer advertisement containing shell metacharacters in model or PDL
2. cups-browsed discovers printer and auto-configures queue
3. Shell metacharacters are embedded into generated System V scripts
4. Scripts execute attacker commands during queue setup or printing

How to detect it

Review cups-browsed and CUPS logs for unexpected queue creations or errors during printer discovery; search for unusual processes or commands executed around printer advertisement timestamps.

What your security team should do

• Upgrade cups-filters to 1.0.51 or later on all affected systems
• Disable or restrict cups-browsed service where printer discovery is unnecessary
• Segment networks to limit exposure of IPP ports to untrusted devices