CVE-2013-6427: Code Injection

Published Dec 9, 2013

Updated

upgrade.py in the hp-upgrade service in HP Linux Imaging and Printing (HPLIP) 3.x through 3.13.11 launches a program from an http URL, which allows man-in-the-middle attackers to execute arbitrary code by gaining control over the client-server data stream.

Affected Software

36 affected components

HP Linux Imaging and Printing Project=3.9.2

HP Linux Imaging and Printing Project=3.9.4

HP Linux Imaging and Printing Project=3.9.4-b

HP Linux Imaging and Printing Project=3.9.4b

HP Linux Imaging and Printing Project=3.9.6

HP Linux Imaging and Printing Project=3.9.8

HP Linux Imaging and Printing Project=3.9.10

HP Linux Imaging and Printing Project=3.9.12

HP Linux Imaging and Printing Project=3.10.2

HP Linux Imaging and Printing Project=3.10.5

HP Linux Imaging and Printing Project=3.10.6

HP Linux Imaging and Printing Project=3.10.9

HP Linux Imaging and Printing Project=3.11.1

HP Linux Imaging and Printing Project=3.11.3

HP Linux Imaging and Printing Project=3.11.3-a

HP Linux Imaging and Printing Project=3.11.3a

HP Linux Imaging and Printing Project=3.11.5

HP Linux Imaging and Printing Project=3.11.7

HP Linux Imaging and Printing Project=3.11.10

HP Linux Imaging and Printing Project=3.11.12

HP Linux Imaging and Printing Project=3.12.2

HP Linux Imaging and Printing Project=3.12.4

HP Linux Imaging and Printing Project=3.12.6

HP Linux Imaging and Printing Project=3.12.9

HP Linux Imaging and Printing Project=3.12.10

HP Linux Imaging and Printing Project=3.12.10-a

HP Linux Imaging and Printing Project=3.12.11

HP Linux Imaging and Printing Project=3.13.2

HP Linux Imaging and Printing Project=3.13.3

HP Linux Imaging and Printing Project=3.13.4

HP Linux Imaging and Printing Project=3.13.5

HP Linux Imaging and Printing Project=3.13.6

HP Linux Imaging and Printing Project=3.13.7

HP Linux Imaging and Printing Project=3.13.8

HP Linux Imaging and Printing Project=3.13.9

HP Linux Imaging and Printing Project=3.13.10

Event History

Dec 9, 2013

CVE Published

via MITRE·06:00 PM

Data Sourced

via MITRE·06:00 PM

Description

Data Sourced

via NVD·06:55 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2013-6427?

CVE-2013-6427 has a medium severity level due to its potential to allow remote code execution through man-in-the-middle attacks.

How do I fix CVE-2013-6427?

To fix CVE-2013-6427, upgrade to HPLIP version 3.13.11 or later, which addresses this vulnerability.

What types of attacks does CVE-2013-6427 expose systems to?

CVE-2013-6427 exposes systems to man-in-the-middle attacks that can lead to arbitrary code execution.

Which software versions are affected by CVE-2013-6427?

CVE-2013-6427 affects HP Linux Imaging and Printing (HPLIP) versions 3.9.2 through 3.13.10.

Is there a workaround for CVE-2013-6427?

Currently, there are no official workarounds for CVE-2013-6427 other than updating to a patched version of HPLIP.