Published: 23/09/2013 Updated: 14/01/2014

CVSS v2 Base Score: 6.9 | Impact Score: 10 | Exploitability Score: 3.4

VMScore: 614

Vector: AV:L/AC:M/Au:N/C:C/I:C/A:C

The check_permission_v1 function in base/pkit.py in HP Linux Imaging and Printing (HPLIP) up to and including 3.13.9 does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a (1) setuid process or (2) pkexec process.

Vulnerable Product	Search on Vulmon	Subscribe to Product
hp linux imaging and printing project 3.13.7
hp linux imaging and printing project 3.13.8
hp linux imaging and printing project 3.10.6
hp linux imaging and printing project 3.10.9
hp linux imaging and printing project 3.12.10
hp linux imaging and printing project 3.12.11
hp linux imaging and printing project 3.9.10
hp linux imaging and printing project 3.9.12
hp linux imaging and printing project 3.13.4
hp linux imaging and printing project 2.0
hp linux imaging and printing project 2.7.10
hp linux imaging and printing project 3.11.3a
hp linux imaging and printing project 3.11.5
hp linux imaging and printing project 3.12.6
hp linux imaging and printing project 3.12.9
hp linux imaging and printing project 3.9.4b
hp linux imaging and printing project 3.9.6
hp linux imaging and printing project 3.13.5
hp linux imaging and printing project 3.13.6
hp linux imaging and printing project 3.10.2
hp linux imaging and printing project 3.10.5
hp linux imaging and printing project 3.11.7
hp linux imaging and printing project 3.13.2
hp linux imaging and printing project 3.13.3
hp linux imaging and printing project 3.9.8
hp linux imaging and printing project 3.13.9
hp linux imaging and printing project 1.0
hp linux imaging and printing project 3.11.1
hp linux imaging and printing project 3.11.10
hp linux imaging and printing project 3.11.3
hp linux imaging and printing project 3.12.2
hp linux imaging and printing project 3.12.4
hp linux imaging and printing project 3.9.2
hp linux imaging and printing project 3.9.4

Synopsis Important: hplip security update Type/Severity Security Advisory: Important Topic Updated hplip packages that fix one security issue are now available forRed Hat Enterprise Linux 6The Red Hat Security Response Team has rated this update as havingimportant security impact A Common Vulnerability Sc ...

Debian Bug report logs - #723716 hplip: CVE-2013-4325 Package: hplip; Maintainer for hplip is Debian Printing Team <debian-printing@listsdebianorg>; Source for hplip is src:hplip (PTS, buildd, popcon) Reported by: Moritz Muehlenhoff <jmm@inutilorg> Date: Thu, 19 Sep 2013 06:06:02 UTC Severity: grave Tags: patch, ...

HPLIP could be tricked into bypassing polkit authorizations ...

Multiple vulnerabilities have been found in the HP Linux Printing and Imaging System: Insecure temporary files, insufficient permission checks in PackageKit and the insecure hp-upgrade service has been disabled For the oldstable distribution (squeeze), these problems have been fixed in version 3106-2+squeeze2 For the stable distribution (wheezy ...

The check_permission_v1 function in base/pkitpy in HP Linux Imaging and Printing (HPLIP) through 3139 does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a (1) setuid process or (2) pkexec process ...

CWE-264 https://bugzilla.redhat.com/show_bug.cgi?id=1006674 https://bugzilla.redhat.com/show_bug.cgi?id=1002375 http://www.ubuntu.com/usn/USN-1956-1 http://rhn.redhat.com/errata/RHSA-2013-1274.html http://lists.opensuse.org/opensuse-updates/2013-10/msg00062.html http://lists.opensuse.org/opensuse-updates/2013-11/msg00000.html http://www.debian.org/security/2013/dsa-2829 https://access.redhat.com/errata/RHSA-2013:1274 https://usn.ubuntu.com/1956-1/https://nvd.nist.gov https://access.redhat.com/security/cve/cve-2013-4325

CVE-2013-4325

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect