CVE-2017-15400

Vulnerability

Insufficient restriction of IPP filters in CUPS, specifically a printer zeroconfig CRLF issue, allowed a remote attacker to execute arbitrary commands with the privileges of the cups daemon. This vulnerability affects Google Chrome OS prior to version 62.0.3202.74. The attack vector involves a crafted PPD file that exploits the CRLF injection to bypass filter restrictions [1].

Exploitation

An attacker with network access can send a specially crafted PPD file to the CUPS service. By embedding CRLF sequences in the PPD file, the attacker can inject arbitrary commands into the IPP filter processing, leading to command execution. No authentication is required for this remote attack [1].

Impact

Successful exploitation allows the attacker to execute arbitrary commands with the same privileges as the cups daemon, which typically runs as root. This can result in full compromise of the affected system, including data theft, installation of malware, or further lateral movement within the network [1].

Mitigation

The vulnerability is fixed in Google Chrome OS version 62.0.3202.74. For CUPS installations on other platforms, upgrading to version 2.2.8 or later (e.g., via Gentoo's >=net-print/cups-2.2.8) is recommended. No workaround is available [1].