CVE-2011-2697Vulnerability
Reported by 1 independent source · first reported by Elastic Security Labs · last reported
Last reported 2 years ago
What the reports say
1 report, newest first · the exact sentence from each-
Cups Overflow: When your printer spills more than Ink“…es the foomatic-rip filter, which permits the execution of arbitrary commands through the FoomaticRIPCommandLine directive, a known (CVE-2011-2697, CVE-2011-2964) but unpatched issue since 2011.”
Indicators reported together
named in the same reports- hxxps://github[.]com/elastic/detection-rules/blob/a3e89a7fabe90a6f9ce02b58d5a948db8d231ee5/rules/linux/execution_cupsd_foomatic_rip_shell_execution.tomlin 1 report
- hxxps://github[.]com/elastic/detection-rules/blob/a3e89a7fabe90a6f9ce02b58d5a948db8d231ee5/rules/linux/execution_cupsd_foomatic_rip_lp_user_execution.tomlin 1 report
- hxxps://github[.]com/elastic/detection-rules/blob/a3e89a7fabe90a6f9ce02b58d5a948db8d231ee5/rules/linux/command_and_control_cupsd_foomatic_rip_netcon.tomlin 1 report
- hxxps://github[.]com/elastic/detection-rules/blob/a3e89a7fabe90a6f9ce02b58d5a948db8d231ee5/rules/linux/execution_cupsd_foomatic_rip_file_creation.tomlin 1 report
- tcpsocket[.]newin 1 report
- hxxps://github[.]com/elastic/detection-rules/blob/a3e89a7fabe90a6f9ce02b58d5a948db8d231ee5/rules/linux/execution_cupsd_foomatic_rip_suspicious_child_execution.tomlin 1 report
- hxxps://www.evilsocket[.]net/2024/09/26/Attacking-UNIX-systems-via-CUPS-Part-I/in 1 report
- www.evilsocket[.]netin 1 report
- hxxps://github[.]com/RickdeJager/cupshax/blob/main/cupshax.pyin 1 report
Copy these 9 indicators · defanged
Also named with it: CVE-2011-2964, CVE-2024-47176, CVE-2024-47076, CVE-2024-47175, CVE-2024-47177
Thanks — we review every report.