HP Linux Imaging and Printing (HPLIP) through 3.12.4 allows local users to overwrite arbitrary files via a symlink attack on the (1) /tmp/hpcupsfilterc#.bmp, (2) /tmp/hpcupsfilterk#.bmp, (3) /tmp/hpcupsjob#.out, (4) /tmp/hpijs#####.out, or (5) /tmp/hppsjob#.out temporary file, a different vulnerability than CVE-2011-2722.

HP Linux Imaging and Printing (HPLIP) before 3.13.2 uses world-writable permissions for /var/log/hp and /var/log/hp/tmp, which allows local users to delete log files via standard filesystem operations.

A temporary file handling flaw was reported [1] in prnt/hpijs/hpcupsfax.cpp, the hplip HP CUPS filter. Because a predicatable temporary filename is used (/tmp/hpcupsfax.out), an attacker could use a symlink attack to overwrite an arbitrary file with the privileges of the process running the HP CUPS fax filter.

422 FILE fp; 423 fp = NULL; 424 if (iLogLevel & SAVEPCLFILE) 425 { 426 fp = fopen ("/tmp/hpcupsfax.out", "w"); 427 system ("chmod 666 /tmp/hpcupsfax.out"); 428 } 429 while ((i = read (fdFax, pTmp, iSize)) > 0) 430 { 431 write (STDOUTFILENO, pTmp, i); 432 if (iLogLevel & SAVEPCLFILE && fp) 433 { 434 fwrite (pTmp, 1, i, fp); 435 } 436 } 437 free (pTmp);

This flaw only exists in hplip 3.x and is not present in earlier versions of hplip.

[1] https://bugzilla.novell.com/showbug.cgi?id=704608

Statement:

This issue did not affect the versions of hplip as shipped with Red Hat Enterprise Linux 5. A future update in Red Hat Enterprise Linux 5 (for hplip3) and 6 may address this flaw.