Executive Summary
| Summary | |
|---|---|
| Title | HPLIP vulnerabilities |
| Informations | |||
|---|---|---|---|
| Name | USN-2085-1 | First vendor Publication | 2014-01-21 |
| Vendor | Ubuntu | Last vendor Modification | 2014-01-21 |
| Severity (Vendor) | N/A | Revision | N/A |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:M/Au:N/C:P/I:P/A:P) | |||
|---|---|---|---|
| Cvss Base Score | 6.8 | Attack Range | Network |
| Cvss Impact Score | 6.4 | Attack Complexity | Medium |
| Cvss Expoit Score | 8.6 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 13.10 - Ubuntu 12.10 - Ubuntu 12.04 LTS - Ubuntu 10.04 LTS Summary: Several security issues were fixed in HPLIP. Software Description: - hplip: HP Linux Printing and Imaging System (HPLIP) Details: It was discovered that the HPLIP Polkit daemon incorrectly handled temporary files. A local attacker could possibly use this issue to overwrite arbitrary files. In the default installation of Ubuntu 12.04 LTS and higher, this should be prevented by the Yama link restrictions. (CVE-2013-6402) It was discovered that HPLIP contained an upgrade tool that would download code in an unsafe fashion. If a remote attacker were able to perform a man-in-the-middle attack, this flaw could be exploited to execute arbitrary code. (CVE-2013-6427) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 13.10: Ubuntu 12.10: Ubuntu 12.04 LTS: Ubuntu 10.04 LTS: In general, a standard system update will make all the necessary changes. References: Package Information: |
Original Source
| Url : http://www.ubuntu.com/usn/USN-2085-1 |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 50 % | CWE-94 | Failure to Control Generation of Code ('Code Injection') |
| 50 % | CWE-59 | Improper Link Resolution Before File Access ('Link Following') |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:20191 | |||
| Oval ID: | oval:org.mitre.oval:def:20191 | ||
| Title: | DSA-2829-1 hplip - several | ||
| Description: | Multiple vulnerabilities have been found in the HP Linux Printing and Imaging System: Insecure temporary files, insufficient permission checks in PackageKit and the insecure hp-upgrade service has been disabled. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-2829-1 CVE-2013-0200 CVE-2013-4325 CVE-2013-6402 CVE-2013-6427 | Version: | 5 |
| Platform(s): | Debian GNU/Linux 6.0 Debian GNU/Linux 7 Debian GNU/kFreeBSD 6.0 Debian GNU/kFreeBSD 7 | Product(s): | hplip |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:21926 | |||
| Oval ID: | oval:org.mitre.oval:def:21926 | ||
| Title: | USN-2085-1 -- hplip vulnerabilities | ||
| Description: | Several security issues were fixed in HPLIP. | ||
| Family: | unix | Class: | patch |
| Reference(s): | USN-2085-1 CVE-2013-6402 CVE-2013-6427 | Version: | 5 |
| Platform(s): | Ubuntu 13.10 Ubuntu 12.10 Ubuntu 12.04 Ubuntu 10.04 | Product(s): | hplip |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:25107 | |||
| Oval ID: | oval:org.mitre.oval:def:25107 | ||
| Title: | SUSE-SU-2014:0188-2 -- Security update for hplip | ||
| Description: | hplip was updated to fix three security issues: * CVE-2013-0200: Some local file overwrite problems via predictable /tmp filenames were fixed. * CVE-2013-4325: hplip used an insecure polkit DBUS API (polkit-process subject race condition) which could lead to local privilege escalation. * CVE-2013-6402: hplip uses arbitrary file creation/overwrite (via hardcoded file name /tmp/hp-pkservice.log). | ||
| Family: | unix | Class: | patch |
| Reference(s): | SUSE-SU-2014:0188-2 CVE-2013-0200 CVE-2013-4325 CVE-2013-6402 | Version: | 3 |
| Platform(s): | SUSE Linux Enterprise Server 11 SUSE Linux Enterprise Desktop 11 | Product(s): | hplip |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:25362 | |||
| Oval ID: | oval:org.mitre.oval:def:25362 | ||
| Title: | SUSE-SU-2014:0188-1 -- Security update for hplip | ||
| Description: | hplip was updated to fix three security issues: * CVE-2013-0200: Some local file overwrite problems via predictable /tmp filenames were fixed. * CVE-2013-4325: hplip used an insecure polkit DBUS API (polkit-process subject race condition) which could lead to local privilege escalation. * CVE-2013-6402: hplip uses arbitrary file creation/overwrite (via hardcoded file name /tmp/hp-pkservice.log) | ||
| Family: | unix | Class: | patch |
| Reference(s): | SUSE-SU-2014:0188-1 CVE-2013-0200 CVE-2013-4325 CVE-2013-6402 | Version: | 3 |
| Platform(s): | SUSE Linux Enterprise Server 11 SUSE Linux Enterprise Desktop 11 | Product(s): | hplip |
| Definition Synopsis: | |||
| |||
CPE : Common Platform Enumeration
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2014-06-13 | Name : The remote openSUSE host is missing a security update. File : openSUSE-2014-80.nasl - Type : ACT_GATHER_INFO |
| 2014-02-04 | Name : The remote SuSE 11 host is missing one or more security updates. File : suse_11_hplip-140116.nasl - Type : ACT_GATHER_INFO |
| 2014-01-27 | Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2014-023.nasl - Type : ACT_GATHER_INFO |
| 2014-01-22 | Name : The remote Ubuntu host is missing a security-related patch. File : ubuntu_USN-2085-1.nasl - Type : ACT_GATHER_INFO |
| 2013-12-31 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-2829.nasl - Type : ACT_GATHER_INFO |
| 2013-12-06 | Name : The remote Slackware host is missing a security update. File : Slackware_SSA_2013-339-04.nasl - Type : ACT_GATHER_INFO |
Alert History
| Date | Informations |
|---|---|
| 2014-02-17 12:03:00 |
|
| 2014-01-21 17:18:33 |
|
