CUPS bugs: your server doesn’t need a printer

Last week a researcher published a chain of bugs in CUPS, the printing system on most Linux and Unix machines. The weak part is cups-browsed, which listens on UDP port 631 for printers announcing themselves, from anywhere.

An attacker can send one packet that adds a fake printer. When someone prints to it, the attacker’s command runs. Scans found hundreds of thousands of machines with that port open to the internet.

It needs a print job to trigger, so it’s not the end of the world. But the fix is so easy there’s no reason to wait:

sudo systemctl disable --now cups-browsed

Then:

• Servers almost never need CUPS. Remove the packages if nothing prints.
• Block UDP 631 at the firewall, inbound from the internet.
• Install your distribution’s updates for cups-browsed, libcupsfilters and libppd as they arrive.

The wider point: every service a server runs is something to patch. Default installs often include things you never asked for. Run ss -tulpn once in a while and ask “why is that listening?”