PT-2009-2816 · Hewlett Packard · Hplip

Matt Zimmerman + 1 · Published 2009-01-15 · Updated 2009-01-31 · CVE-2009-0122

Positive Technologies (AI Summary)

CVSS v2.0

6.9

Medium

Base vector

AV:L/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions HP Linux Imaging and Printing (HPLIP) versions 2.7.7 through 2.8.2

Description The issue allows local users to change the ownership of arbitrary files via manipulations before an HPLIP installation or upgrade by an administrator. This is related to the product's attempt to correct the ownership of its configuration files within home directories.

Recommendations For HP Linux Imaging and Printing (HPLIP) versions 2.7.7 through 2.8.2, consider restricting access to the hplip.postinst script until a patch is available. As a temporary workaround, avoid running the HPLIP installation or upgrade as an administrator until the issue is resolved.

Exploit

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2009-0122

Affected Products

Hplip

References · 5

• 🔥 https://launchpad.net/bugs/191299 · Exploit
• http://securityfocus.com/bid/33249 · Patch
• http://ubuntu.com/usn/usn-708-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-0122 · Security Note
• http://secunia.com/advisories/33539 · Note