PT-2011-1138 · Linux Printing+2 · Foomatic-Filters+2

Published 2011-07-29 · Updated 2024-06-15 · CVE-2011-2697

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions foomatic-filters versions prior to 4.0.9 foomatic-3.0.2 HPLIP version 3.11.5

Description The issue affects the foomatic-filters package and HPLIP, allowing remote attackers to execute arbitrary code via a crafted FoomaticRIPCommandLine field in a .ppd file, potentially leading to a breach of confidentiality, integrity, and availability of protected information. The exploitation can be carried out remotely.

Recommendations For foomatic-filters versions prior to 4.0.9, update to version 4.0.9 or later. For foomatic-3.0.2, consider disabling the vulnerable package until a patch is available. For HPLIP version 3.11.5, avoid using the FoomaticRIPCommandLine field in .ppd files until the issue is resolved.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2015-07198

BDU:2015-08759

BDU:2015-09438

CVE-2011-2697

DSA-2380-1

OPENSUSE-SU-2024:10083-1

RHSA-2011:1109

RHSA-2011_1109

Affected Products

Hplip

Red Hat

Foomatic-Filters

References · 30

• 🔥 http://openwall.com/lists/oss-security/2011/07/28/1 · Exploit
• 🔥 http://openwall.com/lists/oss-security/2011/07/18/3 · Exploit
• 🔥 https://bugzilla.novell.com/show_bug.cgi?id=698451 · Exploit
• 🔥 https://bugzilla.redhat.com/show_bug.cgi?id=721001 · Exploit
• 🔥 http://openwall.com/lists/oss-security/2011/07/13/3 · Exploit
• http://mandriva.com/security/advisories?name=MDVSA-2011:125 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-08759 · Security Note
• https://bdu.fstec.ru/vul/2015-09438 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2011-2697 · Security Note
• https://osv.dev/vulnerability/CVE-2011-2697 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2011-2697 · Vendor Advisory
• http://security.gentoo.org/glsa/glsa-201203-07.xml · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-07198 · Security Note
• http://ubuntu.com/usn/USN-1194-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2011-2697 · Vendor Advisory