CVE-2011-2722: Low severity hp linux imaging and printing vulnerability
A temporary file handling flaw was reported [1] in prnt/hpijs/hpcupsfax.cpp, the hplip HP CUPS filter. Because a predicatable temporary filename is used (/tmp/hpcupsfax.out), an attacker could use a symlink attack to overwrite an arbitrary file with the privileges of the process running the HP CUPS fax filter.
422 FILE fp; 423 fp = NULL; 424 if (iLogLevel & SAVEPCLFILE) 425 { 426 fp = fopen ("/tmp/hpcupsfax.out", "w"); 427 system ("chmod 666 /tmp/hpcupsfax.out"); 428 } 429 while ((i = read (fdFax, pTmp, iSize)) > 0) 430 { 431 write (STDOUTFILENO, pTmp, i); 432 if (iLogLevel & SAVEPCLFILE && fp) 433 { 434 fwrite (pTmp, 1, i, fp); 435 } 436 } 437 free (pTmp);
This flaw only exists in hplip 3.x and is not present in earlier versions of hplip.
[1] https://bugzilla.novell.com/showbug.cgi?id=704608
Statement:
This issue did not affect the versions of hplip as shipped with Red Hat Enterprise Linux 5. A future update in Red Hat Enterprise Linux 5 (for hplip3) and 6 may address this flaw.
Other sources
The senddatatostdout function in prnt/hpijs/hpcupsfax.cpp in HP Linux Imaging and Printing (HPLIP) 3.x before 3.11.10 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/hpcupsfax.out temporary file.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2011-2722?
CVE-2011-2722 has a medium severity due to potential exploitation through a symlink attack.
How do I fix CVE-2011-2722?
To fix CVE-2011-2722, update to a patched version of the HP Linux Imaging and Printing Project that addresses the temporary file handling flaw.
What are the affected versions for CVE-2011-2722?
Affected versions of the HP Linux Imaging and Printing Project for CVE-2011-2722 include versions up to 3.11.5 and specific versions like 3.9.2, 3.9.4, and others.
What type of vulnerability is CVE-2011-2722?
CVE-2011-2722 is a temporary file handling vulnerability that can lead to file overwriting.
Who is impacted by CVE-2011-2722?
Users running vulnerable versions of the HP Linux Imaging and Printing Project are impacted by CVE-2011-2722.