CVE-2011-2697: Input Validation
foomatic-rip-hplip in HP Linux Imaging and Printing (HPLIP) 3.11.5 allows remote attackers to execute arbitrary code via a crafted FoomaticRIPCommandLine field in a .ppd file.
Other sources
It was found that foomatic-rip universal print filter did not properly sanitize content of "files to be printed" command line argument, prior performing of the print job. A remote attacker could provide a specially-crafted PostScript Printer Description (PPD) file and trick the local user into printing it, which once performed could lead to arbitrary code execution with the privileges of the user running the foomatic-rip tool.
References: [1] https://bugzilla.novell.com/showbug.cgi?id=698451 [2] http://www.openwall.com/lists/oss-security/2011/07/13/3 (CVE Request)
Proposed patch against the foomatic-rip C-source code: [3] https://bugzilla.novell.com/showbug.cgi?id=698451#c24
Proposed patch against the foomatic-rip Perl script: [4] https://bugzilla.novell.com/showbug.cgi?id=698451#c25
— Red Hat
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2011-2697?
CVE-2011-2697 is considered a critical vulnerability due to its potential for remote code execution.
How does CVE-2011-2697 allow remote code execution?
CVE-2011-2697 allows attackers to execute arbitrary code by exploiting a crafted *FoomaticRIPCommandLine field in a .ppd file.
Which software versions are affected by CVE-2011-2697?
CVE-2011-2697 affects HP Linux Imaging and Printing (HPLIP) version 3.11.5.
How do I fix CVE-2011-2697?
To fix CVE-2011-2697, upgrade to a patched version of HP Linux Imaging and Printing that resolves this vulnerability.
What impact does CVE-2011-2697 have on system security?
CVE-2011-2697 can compromise system security by allowing remote attackers to run arbitrary code with the privileges of the print service.