Mageia Advisory 2026-0128: system-config-printer Security Fix — Patching and Print Stack Hardening Guide for Linux Defenders

---
title: CUPS Daemon Spawning Suspicious Child Processes
id: 3f8c2a91-7d4e-4b6a-9c1f-2e5d8a0b4f72
status: experimental
description: Detects the CUPS daemon or print helper processes spawning shells, interpreters, or system utilities. Flaws in printer configuration tooling and malicious PPD filters typically manifest as unexpected command execution in the lp/root context beneath cupsd.
references:
  - https://linuxsecurity.com/advisories/mageia/mageia-2026-0128-system-config-printer
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/02/02
tags:
  - attack.execution
  - attack.t1059
  - attack.privilege_escalation
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/cupsd'
      - '/cups-browsed'
  selection_child:
    Image|endswith:
      - '/bash'
      - '/sh'
      - '/dash'
      - '/python'
      - '/python3'
      - '/perl'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/ncat'
      - '/socat'
      - '/base64'
  filter_legit_filters:
    Image|endswith:
      - '/pdftops'
      - '/pstops'
      - '/foomatic-rip'
      - '/gstoraster'
      - '/rastertogutenprint.5.3'
  condition: selection_parent and selection_child and not filter_legit_filters
falsepositives:
  - Custom CUPS backend scripts deployed by administrators (inventory and allowlist by path)
  - Legitimate vendor printer drivers invoking helper binaries
level: high
---
title: Unauthorized Modification of CUPS Configuration Files
id: 8a1d4e62-3b7f-4c9a-a5e3-6f0c1d8b2e94
status: experimental
description: Detects writes to sensitive CUPS configuration files by processes other than the legitimate printer configuration tooling. Exploitation of print configuration flaws frequently results in attacker-controlled content in printers.conf, cupsd.conf, or PPD files containing malicious cupsFilter directives.
references:
  - https://linuxsecurity.com/advisories/mageia/mageia-2026-0128-system-config-printer
  - https://attack.mitre.org/techniques/T1547/
author: Security Arsenal
date: 2026/02/02
tags:
  - attack.persistence
  - attack.privilege_escalation
  - attack.defense_evasion
logsource:
  category: file_event
  product: linux
detection:
  selection:
    TargetFilename|startswith:
      - '/etc/cups/cupsd.conf'
      - '/etc/cups/printers.conf'
      - '/etc/cups/cups-files.conf'
      - '/etc/cups/ppd/'
      - '/etc/cups/interfaces/'
  filter_tools:
    Image|endswith:
      - '/cupsd'
      - '/system-config-printer'
      - '/cups-pk-helper'
      - '/lpadmin'
      - '/vim'
      - '/nano'
  condition: selection and not filter_tools
falsepositives:
  - Configuration management (Ansible, Puppet) updating print config — allowlist the CM agent path
  - Administrators editing files with editors not in the filter list
level: high
---
title: Polkit Authorization for Printer Administration by Unusual User
id: 5c2e7f38-9a1d-4e6b-b8f4-1c3d5e7a9b06
status: experimental
description: Detects polkit authorization events for CUPS administrative actions (add/remove/modify printer) initiated by accounts outside the expected administrator group. Privilege-escalation flaws in print configuration tooling often present as successful polkit authorizations from unexpected UIDs.
references:
  - https://linuxsecurity.com/advisories/mageia/mageia-2026-0128-system-config-printer
  - https://attack.mitre.org/techniques/T1548/
author: Security Arsenal
date: 2026/02/02
tags:
  - attack.privilege_escalation
  - attack.t1548
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    CommandLine|contains:
      - 'org.opensuse.CupspkHelper'
      - 'org.freedesktop.Print'
      - 'cups-pk-helper'
      - 'lpadmin'
      - 'lpoptions'
  filter_admins:
    User|contains:
      - 'root'
      - 'sysadmin'
  condition: selection and not filter_admins
falsepositives:
  - Desktop users legitimately adding personal printers — tune the filter to your actual admin group
  - Helpdesk staff performing printer support
level: medium

// Hunt for CUPS print-stack abuse indicators across Linux hosts ingesting Syslog into Sentinel
// Covers: cupsd child process anomalies, CUPS config writes, and polkit print authorization events
union isfuzzy=true
(
    Syslog
    | where TimeGenerated > ago(7d)
    | where Facility == "user" or SyslogMessage has_any ("cupsd", "cups-browsed", "cups-pk-helper", "polkitd")
    | where SyslogMessage has_any ("printer-added", "printer-deleted", "printer-modified", "cupsdSetCredentials", "org.opensuse.CupspkHelper")
       or (SyslogMessage has "polkitd" and SyslogMessage has_any ("print", "cups"))
    | project TimeGenerated, Computer, HostIP, ProcessName, SyslogMessage, SeverityLevel
),
(
    DeviceProcessEvents
    | where TimeGenerated > ago(7d)
    | where InitiatingProcessFileName has_any ("cupsd", "cups-browsed")
    | where FileName in~ ("bash", "sh", "dash", "python3", "perl", "curl", "wget", "nc", "ncat", "socat")
    | project TimeGenerated, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, AccountName, SHA256
)
| order by TimeGenerated desc

-- Velociraptor hunt artifact: audit CUPS attack surface on Mageia 10 endpoints
-- Collects recent CUPS config modifications, PPD files with suspicious directives,
-- running print-stack processes, and the installed system-config-printer version.

LET config_files <= SELECT FullPath, Mtime, Size,
    parse_string(text=read_file(filename=FullPath), regex='(?i)cupsFilter|FoomaticRIPCommandLine') AS SuspiciousDirectives
FROM glob(globs=['/etc/cups/cupsd.conf', '/etc/cups/printers.conf', '/etc/cups/ppd/*.ppd'])
WHERE Mtime > now() - 604800

LET print_procs <= SELECT Pid, Ppid, Name, CommandLine, Username, CreateTime
FROM pslist()
WHERE Name =~ 'cupsd|cups-browsed|cups-pk-helper'

LET pkg_version <= SELECT * FROM execve(argv=['/bin/rpm', '-q', 'system-config-printer', '--queryformat', '%{NAME}-%{VERSION}-%{RELEASE}\n'])

SELECT * FROM config_files
UNION ALL SELECT NULL AS FullPath, NULL AS Mtime, NULL AS Size, NULL AS SuspiciousDirectives FROM print_procs

#!/bin/bash
# MGASA-2026-0128 verification and CUPS hardening audit — Mageia 10
# Run as root. Exit code 0 = patched and no critical findings.

set -u

FAIL=0

echo "=== [1/4] Verifying Mageia release ==="
if ! grep -qi 'mageia' /etc/os-release; then
  echo "[!] This host does not appear to be Mageia. Aborting."
  exit 1
fi
grep -E '^(NAME|VERSION)=' /etc/os-release

echo
echo "=== [2/4] Applying security update for system-config-printer ==="
# Pull latest metadata and update only the affected package plus deps
urpmi.update -a
urpmi --auto --auto-select system-config-printer || {
  echo "[!] urpmi update failed — trying dnf fallback"
  dnf upgrade -y --refresh system-config-printer || { echo "[!!] Update FAILED"; FAIL=1; }
}

INSTALLED=$(rpm -q system-config-printer --queryformat '%{NAME}-%{VERSION}-%{RELEASE}\n' 2>/dev/null)
echo "[+] Installed: ${INSTALLED:-NOT INSTALLED}"

echo
echo "=== [3/4] Auditing CUPS network exposure ==="
# CUPS should not be listening on all interfaces unless this is a print server
if ss -lntup | grep -q ':631.*0.0.0.0'; then
  echo "[!] cupsd is listening on ALL interfaces (port 631). Restrict to localhost unless this is a dedicated print server:"
  echo "    Edit /etc/cups/cupsd.conf -> 'Listen localhost:631' and remove 'Browsing On'"
  FAIL=1
else
  echo "[+] cupsd is not exposed on all interfaces."
fi

# cups-browsed is a known network attack surface — disable if not required
if systemctl is-active --quiet cups-browsed; then
  echo "[!] cups-browsed is RUNNING. Disable unless network printer discovery is required:"
  echo "    systemctl disable --now cups-browsed"
  FAIL=1
else
  echo "[+] cups-browsed is not active."
fi

echo
echo "=== [4/4] Checking for recently modified / suspicious CUPS configs ==="
find /etc/cups -type f -mtime -7 -name '*.conf' -o -type f -mtime -7 -name '*.ppd' 2>/dev/null | while read -r f; do
  echo "    Recently modified: $f"
  grep -HiE 'cupsFilter|FoomaticRIPCommandLine|\*cupsFilter2' "$f" 2>/dev/null && echo "    [!!] Suspicious PPD directive in $f — investigate" && FAIL=1
done

# Check for unexpected CUPS admin authorizations in the journal
echo "[+] Recent polkit authorizations touching print actions:"
journalctl _COMM=polkitd --since '7 days ago' 2>/dev/null | grep -iE 'print|cups' | tail -n 20 || echo "    (none found)"

echo
if [ "$FAIL" -eq 0 ]; then
  echo "=== RESULT: PASS — update applied, no critical exposure findings ==="
else
  echo "=== RESULT: ACTION REQUIRED — review findings above ==="
fi
exit $FAIL