PT-2008-4377 · Hewlett Packard+1 · Hplip+1

Marc Schoenefeld · Published 2008-08-12 · Updated 2017-09-29 · CVE-2008-2940

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions HPLIP version 1.6.7

Description The issue in HPLIP allows local users to gain privileges and send e-mail messages from the root account. This is due to vectors related to the setalerts message and the lack of validation of the device URI associated with an event message.

Recommendations For HPLIP version 1.6.7, consider restricting access to the setalerts message and validating the device URI associated with event messages to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2008-2940

RHSA-2008:0818

RHSA-2008_0818

Affected Products

Hplip

Red Hat

References · 21

• https://security-tracker.debian.org/tracker/CVE-2008-2940 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2008-10/msg00006.html · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2008-2940 · Vendor Advisory
• http://ubuntu.com/usn/USN-674-2 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2008:169 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2008-2940 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-2940 · Security Note
• http://redhat.com/support/errata/RHSA-2008-0818.html · Vendor Advisory
• http://ubuntu.com/usn/USN-674-1 · Vendor Advisory
• http://secunia.com/advisories/32316 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/44441 · Note
• https://access.redhat.com/security/cve/CVE-2008-2941 · Note
• https://access.redhat.com/errata/RHSA-2008:0818 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=455235 · Note
• http://secunia.com/advisories/32792 · Note