PaperCut NG/MF Security Bulletin (May 2024)

Executive Summary

This security bulletin covers the improvements in the newly released versions of PaperCut NG/MF (version 23.0.9 and later). This includes third party dependency updates as part of our ongoing security initiatives. This release also includes fixes for the CVEs addressed in this bulletin.

While PaperCut has assessed these issues as posing a low security risk in practice, we recommend organizations with PaperCut NG/MF servers allowing console or local login access for non-admin users should prioritize this upgrade.

How to upgrade

Perform a standard over-the-top update . This is the simplest way to do it:

1. Log in to the PaperCut NG/MF admin interface and click the About tab.
2. Click the Check for updates button.
3. Download the latest update.
4. Install over-the-top of your existing install.
5. Done - the version under About > Version info should now show the latest version.

Security issues addressed

Acknowledgements

PaperCut would like to thank the researchers working with TrendMicro as part of their ZDI program. Trend Micro and PaperCut have worked together over the last 12 months to ensure that all their research and testing of PaperCut products is responsibly disclosed and collaboratively released.

FAQs

The Check for updates link in the PaperCut NG/MF admin interface allows customers to download the latest version of PaperCut NG or MF. You will find this at PaperCut NG/MF Admin interface > About > Version info > Check for updates.

You can also find your PaperCut partner or reseller information on the Help tab (or About tab in older versions) on the PaperCut Web admin interface.

Alternatively, direct downloads are available on the upgrade page . It’s easy to identify your edition of PaperCut - it’s on the About tab and in the footer of your PaperCut Web admin login.

Applying these fixes follows the standard upgrade process for PaperCut Application Servers and Site Servers, following the Upgrading PaperCut MF & NG (upgrade steps) documentation.

Yes.

If you’re using Web Print with default mode (where your Web Print documents are printed through the Application Server) then you’re covered by the Application Server upgrade above. No further steps are required.

If you’re using Web Print with Sandbox mode (where you have other server(s) separate from your Application Server, running the PaperCut Web Print Server service), you’ll need to update those servers by re-running the Web Print installation on those servers. For more detailed instructions, follow the Step 2: Install Web Print steps from the “Set up Web Print: Sandbox mode” manual page.

No, this is a standard over the top upgrade.

Yes. Organizations not using Web Print can stop the PaperCut Web Print Server service. See Stopping and Starting PaperCut Services for more information. Note that you should also disable the service to stop it from automatically starting when the Windows Server is started.

This upgrade is recommended for all PaperCut organizations, however, organizations with PaperCut NG/MF servers that are accessible from the Internet (e.g. open ports), or have untrusted actors within the network (e.g. a large University) are strongly advised to upgrade.

No. This release includes all previous fixes released, and you can upgrade directly to this release from any previous version of PaperCut NG/MF.

In this case since these vulnerabilities are not rated as critical, the enhancements are only being included in our 23.0.9 (and later) releases, and are not being applied (back-ported) to older supported versions.

See our supported versions policy for more information.

Security notifications

“How do I sign-up for PaperCut’s security mailing list?”

In order to get timely notifications of security news (including security related fixes or vulnerability information) please subscribe to our security notifications list via our Security notifications sign-up form . If you’re a sys admin or if you look after PaperCut product implementations at your organization, this list will help you be amongst the first to hear of any security related news or updates.

Updates