CUPS Flaws Allow Linux Remote DoS (CVE-2025-58364, CVSS 6.5) and Authentication Bypass (CVE-2025-58060, CVSS 8.0)

Estimated reading time: 15 minutes

  • CVE-2025-58364: Remote DoS vulnerability can crash CUPS processes.
  • CVE-2025-58060: Authentication bypass allows unauthorized access to CUPS servers.
  • Upgrade to CUPS version 2.4.14 or later to mitigate these risks.
  • Implement network segmentation and firewall configuration to protect CUPS.
  • PurpleOps can help detect and prevent exploitation of these vulnerabilities.

Table of Contents

The open-source printing system CUPS (Common Unix Printing System) has recently been patched to address two security vulnerabilities. These flaws, identified as CVE-2025-58364 and CVE-2025-58060, can lead to remote denial-of-service (DoS) attacks and authentication bypass on Linux systems. Understanding the nature of these vulnerabilities and how to mitigate them is crucial for maintaining the security and availability of printing services.

Understanding the CUPS Vulnerabilities: CVE-2025-58364 and CVE-2025-58060

CUPS, a standards-based, open-source printing system, is widely used across Linux and Unix-like operating systems. This makes any vulnerability within CUPS a broad concern for enterprise, educational, and governmental environments. The two vulnerabilities recently identified pose distinct risks:

CVE-2025-58364: Remote DoS via Null Dereference (CVSS 6.5)

This medium-severity vulnerability arises from unsafe deserialization and validation of printer attributes within the libcups library. Specifically, a logic error in the ipp_read_io() function leads ippValidateAttributes() to dereference a null pointer. This occurs when an attacker crafts a malicious response to printer attribute requests.

An attacker on the same subnet can exploit this flaw by sending a crafted printer attributes response, causing cups and cups-browsed to crash. This disruption affects any machine listening for printers on the local network, impacting printing services across Linux desktops and servers. While primarily a local network threat, systems exposed to the internet with older, unfixed vulnerabilities could potentially be at risk of remote attacks.

CVE-2025-58060: Authentication Bypass with AuthType Negotiate (CVSS 8.0)

This high-severity vulnerability enables attackers to bypass authentication under specific CUPS configurations. If the AuthType is set to anything other than Basic, and a request contains an Authorization: Basic ... header, the password check is skipped.

This means an attacker can send a specially crafted request and gain unauthorized access without valid credentials. This direct authentication bypass could allow attackers to perform administrative actions on printers, queues, and print jobs, affecting any system where CUPS is configured with AuthType values other than Basic.

Technical Deep Dive: Analyzing the Vulnerabilities

A closer look at the technical details of these vulnerabilities provides a clearer understanding of the risks involved.

CVE-2025-58364: Null Dereference in libcups

The vulnerability lies in how CUPS handles printer attributes. The libcups library deserializes and validates these attributes, but a flaw in the logic allows for a null pointer dereference. Specifically, the ipp_read_io() function, responsible for reading IPP (Internet Printing Protocol) data, contains a logic bug. This bug can cause the ippValidateAttributes() function to dereference a null pointer when processing a crafted printer attributes response from an attacker.

The exploit scenario involves an attacker on the same network responding to a printer attribute request with a malicious payload. This payload triggers the null pointer dereference, causing the CUPS processes (cupsd or cups-browsed) to crash. This crash disrupts printing services for all users relying on those processes.

CVE-2025-58060: Authentication Bypass Mechanism

The authentication bypass vulnerability stems from how CUPS handles authentication when the AuthType is not set to Basic. In configurations where AuthType is set to Negotiate or another method, CUPS should still validate credentials provided in an Authorization: Basic ... header. However, a flaw in the code causes CUPS to skip the password check if such a header is present, effectively bypassing authentication.

An attacker can exploit this by sending a request with a crafted Authorization: Basic header, even without providing valid credentials. This allows the attacker to perform administrative actions on the CUPS server, such as modifying printer configurations, managing print queues, or even injecting malicious print jobs.

Impact Assessment: Potential Consequences of the Vulnerabilities

The impact of these vulnerabilities varies depending on the specific configuration and environment.

CVE-2025-58364: DoS Impact

  • Local Network Disruption: The primary impact is the disruption of printing services on the local network. Any machine relying on the affected CUPS processes will be unable to print until the processes are restarted.
  • Potential Remote Exploitation: While primarily a local threat, systems exposed to the internet with other vulnerabilities could be at risk of a more severe remote attack.
  • Operational Downtime: The crashes can lead to operational downtime, especially in environments where printing is a critical function.

CVE-2025-58060: Authentication Bypass Impact

  • Unauthorized Access: The most significant impact is the potential for unauthorized access to the CUPS server. Attackers can bypass authentication and gain administrative privileges.
  • Configuration Manipulation: Attackers can modify printer configurations, potentially injecting malicious settings or redirecting print jobs to unauthorized locations.
  • Data Exfiltration: Attackers might be able to access sensitive documents in print queues or intercept print jobs for data exfiltration.
  • System Compromise: In a worst-case scenario, attackers could leverage the compromised CUPS server to gain further access to the underlying system, leading to a complete system compromise.

Mitigation Strategies: Protecting Your Systems

To mitigate the risks associated with these vulnerabilities, several steps should be taken:

  1. Upgrade CUPS: The most effective mitigation is to upgrade to CUPS version 2.4.14 or later. This version contains the necessary patches to address both CVE-2025-58364 and CVE-2025-58060.
  2. Network Segmentation: Implement network segmentation to limit the impact of a successful exploit. Restrict access to the CUPS server to only authorized users and systems.
  3. Firewall Configuration: Configure firewalls to block unauthorized access to the CUPS server. Only allow connections from trusted networks and systems.
  4. Disable Unnecessary Services: Disable any unnecessary CUPS services or features that are not required for your environment. This reduces the attack surface and minimizes the potential impact of a vulnerability.
  5. Monitor for Suspicious Activity: Implement monitoring tools to detect suspicious activity on the CUPS server. Look for unusual login attempts, unauthorized configuration changes, or unexpected network traffic. Leverage threat intelligence platforms to stay informed about potential threats and indicators of compromise related to CUPS vulnerabilities.
  6. Review AuthType Configuration: Ensure that the AuthType is properly configured. If possible, use stronger authentication methods than Basic, such as Kerberos or TLS client certificates. If Basic authentication is necessary, ensure that it is protected with TLS encryption.

Practical Takeaways

  • Technical Readers: Immediately patch CUPS to version 2.4.14 or later. Review firewall rules to ensure CUPS traffic is properly segmented and monitored. Analyze CUPS configurations for any non-standard AuthType settings. Consider using network monitoring tools to detect unusual printing activity.
  • Business Leaders: Understand the potential impact of printing service disruptions on business operations. Ensure IT teams are promptly patching critical systems like CUPS. Evaluate the security posture of printing infrastructure as part of a broader cybersecurity risk assessment.

How PurpleOps Can Help

PurpleOps offers a suite of services designed to help organizations strengthen their cybersecurity posture, including mitigating risks associated with vulnerabilities like CVE-2025-58364 and CVE-2025-58060.

  • Breach Detection: PurpleOps’s breach detection capabilities can identify unauthorized access attempts and suspicious activities related to CUPS vulnerabilities, providing early warnings of potential attacks.
  • Cyber Threat Intelligence Platform: Our cyber threat intelligence platform provides real-time insights into emerging threats, including exploits targeting CUPS. This information can help organizations proactively identify and address vulnerabilities before they are exploited.
  • Real-Time Ransomware Intelligence: While these CUPS vulnerabilities do not directly lead to ransomware, a compromised system can be a stepping stone for ransomware attacks. Our real-time ransomware intelligence service helps organizations stay ahead of ransomware threats and protect their systems.
  • Supply-Chain Risk Monitoring: We offer supply-chain risk monitoring to assess the security posture of third-party vendors and suppliers who may be using vulnerable CUPS implementations.
  • Brand Leak Alerting: Protect your sensitive data by utilizing brand leak alerting to identify and address any unauthorized exposure of your organization’s information through compromised printing systems.
  • Dark Web Monitoring Service: Our dark web monitoring service can detect discussions and activities related to CUPS exploits, providing valuable insights into potential threats targeting your organization.

By leveraging PurpleOps’s expertise and services, organizations can enhance their ability to detect, prevent, and respond to cybersecurity threats, ensuring the confidentiality, integrity, and availability of their systems and data.

For more information about our services and how we can help you protect your organization, please visit our website or contact us at our PurpleOps Solutions.

FAQ

What is CUPS?

CUPS (Common Unix Printing System) is a modular printing system that enables a computer to act as a print server. It is open-source and widely used in Linux and Unix-like operating systems.

What is CVE-2025-58364?

CVE-2025-58364 is a remote denial-of-service (DoS) vulnerability in CUPS that arises from a null pointer dereference in the libcups library. It can be exploited by sending a crafted printer attributes response.

What is CVE-2025-58060?

CVE-2025-58060 is an authentication bypass vulnerability in CUPS that allows attackers to bypass authentication if the AuthType is not set to Basic and a request contains an Authorization: Basic ... header.

How do I fix these vulnerabilities?

The most effective mitigation is to upgrade to CUPS version 2.4.14 or later. Additionally, implement network segmentation, firewall configuration, and monitor for suspicious activity.

How can PurpleOps help protect my systems?

PurpleOps offers breach detection, cyber threat intelligence, ransomware intelligence, supply-chain risk monitoring, brand leak alerting, and dark web monitoring services to help organizations detect, prevent, and respond to cybersecurity threats.