CVE-2015-8327

What it actually does

Incomplete blacklist in foomatic-rip and foomatic-filters allows arbitrary command execution when backtick characters are supplied in print job data, bypassing sanitization and invoking a shell.

Why it matters to the business

Compromise of print servers or workstations that process jobs can lead to unauthorized code execution, data exposure, or service disruption across Linux environments using these packages.

How an attack unfolds

An attacker submits a print job containing backtick-wrapped shell commands to a CUPS or Foomatic instance; the filter processes the job title or options, executes the injected commands, and returns output or establishes further access.

How to fix it

Upgrade cups-filters to 1.2.0 or newer and apply current foomatic-filters patches; restrict print job submission to authenticated users and disable the service where printing is unnecessary.

How to confirm the fix worked

Verify installed package versions against the fixed releases, review filter source for backtick handling, and test with non-executing sample jobs containing backticks to confirm sanitization.

Typical attack path

1. Identify exposed CUPS/Foomatic print service
2. Craft and submit print job embedding backtick command injection
3. foomatic-rip or foomatic-filters executes injected commands during job processing
4. Attacker receives command output or pivots within the system

How to detect it

Search CUPS error_log, access_log, and system audit logs for print job submissions containing backtick characters, unexpected shell invocations by foomatic-rip, or anomalous process spawns during job filtering.

• `.*` in job title or options
• foomatic-rip.*exec
• unexpected shell child of cupsd or foomatic

What your security team should do

• Apply package updates to all affected distributions immediately
• Audit and harden print service exposure and authentication
• Add monitoring rules for backtick characters in print job metadata
• Remove or isolate legacy foomatic installations