REDHAT-BUG-319921: Command Injection
Kees Cook of the Ubuntu Security Team has informed us of following security vulnerability in hplip:
I just discovered that the hpssd daemon of hplip is vulnerable to arbitrary command injection via its use of popen3. Other local users can run commands as the invoker of hpssd (usually root, hplip, or a local user). By default, it only listens on localhost, but this is configurable via /etc/hp/hplip.conf, so in the worst-case it is possible this could allow remote root command execution.
Both 2.x and 1.x series appear vulnerable (but not 0.x which used SMTP).
The bug for this is: https://launchpad.net/bugs/149121
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-319921?
The severity of REDHAT-BUG-319921 is high due to its potential for arbitrary command injection allowing local users to execute commands with elevated privileges.
How do I fix REDHAT-BUG-319921?
To fix REDHAT-BUG-319921, update the HPLIP package to the latest version where the vulnerability has been patched.
Who is affected by REDHAT-BUG-319921?
Local users of systems running vulnerable versions of HP HPLIP (from 1.x to 3.x) are affected by REDHAT-BUG-319921.
What is the cause of REDHAT-BUG-319921?
REDHAT-BUG-319921 is caused by improper handling of command execution in the hpssd daemon through the use of popen3.
Is there an exploit available for REDHAT-BUG-319921?
While specific public exploits may not be reported, the nature of the vulnerability allows for local users to potentially exploit it unless fixed.