base/pkit.py in HP Linux Imaging and Printing (HPLIP) through 3.13.11 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/hp-pkservice.log temporary file.

- fix-CVE-2013-6402.dif fixes hardcoded file name     /tmp/hp-pkservice.log in pkit.py (bnc#852368).

  - disable_hp-upgrade.patch disables hp-upgrade/upgrade.py     for security reasons (bnc#853405). To upgrade HPLIP an     openSUSE software package manager like YaST or zypper     should be used. (CVE-2013-6427)

hplip was updated to fix three security issues :

  - Some local file overwrite problems via predictable /tmp     filenames were fixed. (CVE-2013-0200)

  - hplip used an insecure polkit DBUS API (polkit-process     subject race condition) which could lead to local     privilege escalation. (CVE-2013-4325)

  - hplip uses arbitrary file creation/overwrite (via     hard-coded file name /tmp/hp-pkservice.log).
    (CVE-2013-6402)

Updated hplip packages fix security vulnerabilities :

It was discovered that the HPLIP Polkit daemon incorrectly handled temporary files. A local attacker could possibly use this issue to overwrite arbitrary files (CVE-2013-6402).

It was discovered that HPLIP contained an upgrade tool that would download code in an unsafe fashion. If a remote attacker were able to perform a man-in-the-middle attack, this flaw could be exploited to execute arbitrary code (CVE-2013-6427).

It was discovered that the HPLIP Polkit daemon incorrectly handled temporary files. A local attacker could possibly use this issue to overwrite arbitrary files. In the default installation of Ubuntu 12.04 LTS and higher, this should be prevented by the Yama link restrictions. (CVE-2013-6402)

It was discovered that HPLIP contained an upgrade tool that would download code in an unsafe fashion. If a remote attacker were able to perform a man-in-the-middle attack, this flaw could be exploited to execute arbitrary code. (CVE-2013-6427).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple vulnerabilities have been found in the HP Linux Printing and Imaging System: Insecure temporary files, insufficient permission checks in PackageKit and the insecure hp-upgrade service has been disabled.

ID	Name	Product	Family	Severity
75407	openSUSE Security Update : hplip (openSUSE-SU-2014:0127-1)	Nessus	SuSE Local Security Checks	medium
72277	SuSE 11.2 / 11.3 Security Update : hplip (SAT Patch Numbers 8775 / 8777)	Nessus	SuSE Local Security Checks	medium
72135	Mandriva Linux Security Advisory : hplip (MDVSA-2014:023)	Nessus	Mandriva Local Security Checks	medium
72088	Ubuntu 10.04 LTS / 12.04 LTS / 12.10 / 13.10 : hplip vulnerabilities (USN-2085-1)	Nessus	Ubuntu Local Security Checks	medium
71769	Debian DSA-2829-1 : hplip - several vulnerabilities	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2013-6402

medium

Tenable Plugins

medium

medium

medium

medium

medium