CVE-2015-2265

What it actually does

The remove_bad_chars function fails to sanitize consecutive shell metacharacters in model or PDL fields returned by remote IPP printers, enabling arbitrary command injection into the cups-browsed process.

Why it matters to the business

Systems running affected print-filter software can be compromised remotely without authentication, resulting in potential loss of control over print servers, data exposure, or disruption of printing services across the organization.

How an attack unfolds

An attacker deploys or compromises an IPP printer on the network; when cups-browsed queries it during discovery, the printer returns model or PDL values containing shell metacharacters that bypass the incomplete sanitization and execute attacker-chosen commands on the host.

How to fix it

Upgrade cups-filters to version 1.0.66 or later on all affected systems; disable the cups-browsed service if network printer discovery is not required.

How to confirm the fix worked

Verify installed cups-filters package version is 1.0.66 or newer; inspect source or binary for the updated remove_bad_chars implementation and test that metacharacter sequences no longer execute commands.

Typical attack path

1. Attacker places a malicious or compromised IPP printer on a reachable network segment
2. cups-browsed periodically queries available printers via IPP
3. Printer responds with crafted model or PDL fields containing shell metacharacters
4. remove_bad_chars fails to neutralize the input, resulting in command execution

How to detect it

Review cups-browsed logs for printer announcements containing unusual characters in model or PDL fields; inspect process creation events and command lines spawned by the cups-browsed process for suspicious activity.

• cups-browsed
• remove_bad_chars
• model=
• PDL=

What your security team should do

• Apply the 1.0.66 update or newer immediately on all hosts running cups-filters
• Disable cups-browsed where printer auto-discovery is unnecessary
• Restrict network exposure of print services to trusted segments only
• Add monitoring for unexpected process spawns originating from cups-browsed