PaperCut NG/MF Security Bulletin (March 2024)

Executive Summary

This security bulletin is a follow up to the pre-notification published on 8 March 2024. It provides an overview of the latest security focused release of PaperCut NG/MF (23.0.7) that fixes several vulnerabilities. The issues addressed in this release are part of our ongoing security uplift program which involves internal reviews, penetration testing with external parties, and leveraging the strong relationships we’ve built with researchers in the security industry. 

We recommend all organizations plan an upgrade to this release, however, organizations with PaperCut NG/MF servers that are accessible from the Internet (e.g. open ports), or have untrusted actors within the network (e.g. a large University) are strongly advised to prioritize this upgrade. 

How to fix these vulnerabilities - summary

Perform a standard over-the-top update . This is the simplest way to do it:

1. Log in to the PaperCut NG/MF admin interface and click the About tab.
2. Click the Check for updates button.
3. Download the latest update.
4. Install over-the-top of your existing install.
5. Done - the version under About > Version info should now show the latest version.

Note: For more detailed information, see: How to fix these vulnerabilities (Detailed) .

Security issues addressed

Acknowledgements

PaperCut would like to thank the researchers working with TrendMicro as part of their ZDI program. Trend Micro and PaperCut have worked together over the last 12 months to ensure that all their research and testing of PaperCut products is responsibly disclosed and collaboratively released. 

How to fix these vulnerabilities - detailed

These steps reflect the simplest way to fix all the vulnerabilities listed in this bulletin:

1. Upgrade to one of the fixed versions of PaperCut NG/MF listed in this article (23.0.7 or later, 22.1.5, 21.2.14, 20.1.10).
   • You will need to apply this upgrade to Application Servers and Site Servers.See Upgrading PaperCut MF & NG (upgrade steps) for more information.
2. If you are using Job Ticketing then ensure that Job Ticketing has automatically updated to version 1.0.3123 (or later). See How to check version numbers for more information.
3. If you are using the Universal Print Connector on Secondary Servers then ensure that those Universal Print connectors have automatically updated to version 2024-02-28-2055 (or later). See How to check version numbers for more information. 

FAQs

The Check for updates link in the PaperCut NG/MF admin interface allows customers to download the latest version of PaperCut NG or MF. You will find this at PaperCut NG/MF Admin interface > About > Version info > Check for updates.

You can also find your PaperCut partner or reseller information on the Help tab (or About tab in older versions) on the PaperCut Web admin interface.

Alternatively, direct downloads are available on the upgrade page . It’s easy to identify your edition of PaperCut - it’s on the About tab and in the footer of your PaperCut Web admin login.

Applying these fixes follows the standard upgrade process for PaperCut Application Servers and Site Servers, following the Upgrading PaperCut MF & NG (upgrade steps) documentation.

For a full checklist, see How to fix these vulnerabilities (detailed) above.

No, this is a standard over the top upgrade.

No, there are no recommended mitigations and we recommend upgrading to the latest versions of PaperCut NG/MF. 

This upgrade is recommended for all PaperCut organizations, however, organizations with PaperCut NG/MF servers that are accessible from the Internet (e.g. open ports), or have untrusted actors within the network (e.g. a large University) are strongly advised to upgrade. 

No. This release includes all previous fixes released, and you can upgrade directly to this release from any previous version of PaperCut NG/MF.

Yes, we are supplying upgrades for all supported versions of NG/MF.

• 23.0.7
• 22.1.5
• 21.2.14
• 20.1.10

Direct downloads for these older supported versions are available on the upgrade page .

We strongly recommend all organizations upgrade to the latest version.

To protect organizations against potential n-day attacks, PaperCut did not share specific details publicly until the maintenance releases containing all required fixes became available on 14 March 2024. This is the full extent of information regarding these vulnerabilities that PaperCut is disclosing. 

A common way n-day attacks occur is when bad actors glean information from public sources. By disclosing no information, we are trying to give organizations the maximum lead time on bad actors trying to carry out an n-day attack. 

It should also be noted there are no known active exploits. The pre-notifications on 8 March 2024 were merely a measure to inform organizations so they could plan their out-of-schedule updates.

Security notifications

“How do I sign-up for PaperCut’s security mailing list?”

In order to get timely notifications of security news (including security related fixes or vulnerability information) please subscribe to our security notifications list via our Security notifications sign-up form . If you’re a sys admin or if you look after PaperCut product implementations at your organization, this list will help you be amongst the first to hear of any security related news or updates.

Updates