CVE-2015-8560

What it actually does

Incomplete input sanitization in foomatic-rip allows a semicolon in print job data to break out of the intended command and execute arbitrary shell commands with the privileges of the printing process.

Why it matters to the business

Attackers can gain remote code execution on print servers or workstations handling untrusted jobs, potentially leading to system compromise, lateral movement, or data exposure in environments that still run the affected packages.

How an attack unfolds

An attacker crafts a print job containing a semicolon followed by arbitrary commands in a field processed by foomatic-rip; the incomplete blacklist fails to neutralize the delimiter, resulting in the injected commands being executed by the shell invoked during job processing.

How to fix it

Upgrade cups-filters to version 1.4.0 or later and foomatic-filters to a patched release that fully removes the vulnerable util.c code path; disable the foomatic-rip filter if printing is not required.

How to confirm the fix worked

Verify installed package versions against the 1.4.0 threshold, review print job processing logs for evidence of command execution, and test with a benign semicolon-containing job in a lab environment to confirm the filter no longer spawns unexpected processes.

Typical attack path

1. Identify a network-exposed CUPS or foomatic print queue accepting jobs from untrusted sources.
2. Submit a malicious print job embedding a semicolon and shell commands in a job attribute or filename.
3. foomatic-rip processes the job and passes the unsanitized string to a shell, executing the injected commands.
4. Attacker receives command output or establishes a foothold on the host running the vulnerable filter.

How to detect it

Search CUPS error_log and access_log for print job submissions containing semicolons or unusual shell metacharacters; inspect process creation logs on print servers for child processes spawned by foomatic-rip that are not standard filter binaries.

• foomatic-rip.*;.*sh
• print job containing semicolon followed by shell syntax
• unexpected /bin/sh child of foomatic-rip

What your security team should do

• Prioritize patching all instances of cups-filters and foomatic-filters to the fixed releases.
• Restrict print job submission to authenticated and trusted sources only.
• Monitor for any remaining legacy foomatic installations and plan migration to modern printing stacks.