CVE-2007-5208: Input Validation
hpssd in Hewlett-Packard Linux Imaging and Printing Project (hplip) 1.x and 2.x before 2.7.10 allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a from address, which is not properly handled when invoking sendmail.
Other sources
Kees Cook of the Ubuntu Security Team has informed us of following security vulnerability in hplip:
I just discovered that the hpssd daemon of hplip is vulnerable to arbitrary command injection via its use of popen3. Other local users can run commands as the invoker of hpssd (usually root, hplip, or a local user). By default, it only listens on localhost, but this is configurable via /etc/hp/hplip.conf, so in the worst-case it is possible this could allow remote root command execution.
Both 2.x and 1.x series appear vulnerable (but not 0.x which used SMTP).
The bug for this is: https://launchpad.net/bugs/149121
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/hplipto a version that resolves this vulnerability.Fixed in 1.6.10-4.3 - Upgrade
Upgrade
debian/hplipto a version that resolves this vulnerability.Fixed in 3.22.10+dfsg0-2Fixed in 3.22.10+dfsg0-2+deb12u1Fixed in 3.22.10+dfsg0-8.1+deb13u1Fixed in 3.26.4+dfsg0-4 - Upgrade
Upgrade
hplipto a version that resolves this vulnerability.Fixed in 2.7.10
Event History
Frequently Asked Questions
What is the severity of CVE-2007-5208?
CVE-2007-5208 is classified as a medium-severity vulnerability.
How do I fix CVE-2007-5208?
To fix CVE-2007-5208, upgrade to HP Linux Imaging and Printing Project version 2.7.10 or later.
What systems are affected by CVE-2007-5208?
CVE-2007-5208 affects versions of HP Linux Imaging and Printing Project 1.x and 2.x before 2.7.10.
What type of vulnerability is CVE-2007-5208?
CVE-2007-5208 is a command execution vulnerability due to improper handling of shell metacharacters.
Can CVE-2007-5208 be exploited remotely?
Yes, CVE-2007-5208 can be exploited by context-dependent attackers through crafted email addresses.