The Security Online article only cites Margitelli’s post on the matter. My assumption has been the article used the post as its single source. On one hand, watching MS fuck shit up for years, I want to believe Margitelli. On the other hand, researchers using weird tools and uninterested in reality are why curl is now a CNA.

I’m personally frustrated with Margitelli’s post because it’s all about abandoning responsible disclosure globally rather than naming and shaming (Canonical? Red Hat? Both? Others? If it affects all GNU/Linux I’d expect every single distro maintainer to be named and shamed). Responsible disclosure is our best solution to make sure innocent bystanders don’t get caught in the crossfire. When specific entities don’t abide by responsible disclosure we lambast those specific entities not the entire process built to keep users safe.

This is a real exploit chain in cups-browsed. The tl;dr is that it will add basically anything that knows the correct protocol to your list of available printers, and this can be exploited for RCE if you print to the malicious printer. The service listens on all interfaces by default on UDP 631.

It is not as horrible as it was marketed, but it's real and not great. You may or may not have this service running by default; I didn't on Fedora.

His full write-up is here: https://www.evilsocket.net/2024/09/26/Attacking-UNIX-systems-via-CUPS-Part-I/

Suspicious how the Twitter and Instagram accounts went private since.