PT-2008-4377 · Hewlett Packard+1 · Hplip+1

Marc Schoenefeld · Publicado 2008-08-12 · Atualizado 2017-09-29 · CVE-2008-2940

Positive Technologies (AI Summary)

CVSS v2.0

7.2

Alta

Vetor base

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions HPLIP version 1.6.7

Description The issue in HPLIP allows local users to gain privileges and send e-mail messages from the root account. This is due to vectors related to the setalerts message and the lack of validation of the device URI associated with an event message.

Recommendations For HPLIP version 1.6.7, consider restricting access to the setalerts message and validating the device URI associated with event messages to minimize the risk of exploitation.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2008-2940

RHSA-2008:0818

RHSA-2008_0818

Produtos afetados

Hplip

Red Hat

Referências · 21

• http://secunia.com/advisories/32316 · Nota
• https://security-tracker.debian.org/tracker/CVE-2008-2940 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/44441 · Nota
• http://lists.opensuse.org/opensuse-security-announce/2008-10/msg00006.html · Aviso do Fabricante
• https://access.redhat.com/security/cve/CVE-2008-2941 · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2008-2940 · Aviso do Fabricante
• http://ubuntu.com/usn/USN-674-2 · Aviso do Fabricante
• https://access.redhat.com/errata/RHSA-2008:0818 · Nota
• https://bugzilla.redhat.com/show_bug.cgi?id=455235 · Nota
• http://secunia.com/advisories/32792 · Nota
• http://mandriva.com/security/advisories?name=MDVSA-2008:169 · Aviso do Fabricante
• http://securityfocus.com/bid/30683 · Nota
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10136 · Nota
• https://osv.dev/vulnerability/CVE-2008-2940 · Aviso do Fabricante
• http://secunia.com/advisories/31470 · Nota