Detections
Analytics

Mandrake Linux Security Advisory : hplip (MDKSA-2007:201)

high Nessus Plugin ID 27562

Synopsis

The remote Mandrake Linux host is missing one or more security updates.

Description

A vulnerability in the hpssd tool was discovered where it did not correctly handle shell meta-characters. A local attacker could use this flaw to execute arbitrary commands as the hplip user.

As well, this update fixes a problem with some HP scanners on Mandriva Linux 2007.1, particularly HP PSC 1315, which wouldn't be detected and also fixes a problem with HP 1220 and possibly other models when scanning via the OpenOffice.org suite.

Updated packages have been patched to prevent these issues.

Solution

Update the affected packages.

Plugin Details

Severity: High

ID: 27562

File Name: mandrake_MDKSA-2007-201.nasl

Version: 1.17

Type: local

Published: 10/25/2007

Updated: 1/6/2021

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: High

Score: 7.4

CVSS v2

Risk Factor: High

Base Score: 7.6

Vector: CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:C

Vulnerability Information

CPE: p-cpe:/a:mandriva:linux:hplip, p-cpe:/a:mandriva:linux:hplip-doc, p-cpe:/a:mandriva:linux:hplip-hpijs, p-cpe:/a:mandriva:linux:hplip-hpijs-ppds, p-cpe:/a:mandriva:linux:hplip-model-data, p-cpe:/a:mandriva:linux:lib64hpip0, p-cpe:/a:mandriva:linux:lib64hpip0-devel, p-cpe:/a:mandriva:linux:lib64sane-hpaio1, p-cpe:/a:mandriva:linux:libhpip0, p-cpe:/a:mandriva:linux:libhpip0-devel, p-cpe:/a:mandriva:linux:libsane-hpaio1, cpe:/o:mandriva:linux:2007, cpe:/o:mandriva:linux:2007.1, cpe:/o:mandriva:linux:2008.0

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/Mandrake/release, Host/Mandrake/rpm-list

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 10/22/2007

Exploitable With

CANVAS (D2ExploitPack)

Core Impact

Metasploit (HPLIP hpssd.py From Address Arbitrary Command Execution)

Reference Information

CVE: CVE-2007-5208

CWE: 20

MDKSA: 2007:201