PT-2011-1147 · Microsoft+1 · Smb+4
Vincent Danen
·
Published
2011-08-23
·
Updated
2012-06-15
·
CVE-2011-2899
CVSS v2.0
5.1
Medium
| Vector | AV:N/AC:H/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
system-config-printer versions 0.6.x through 0.7.x
system-config-printer-libs versions 0.7.32.10
system-config-printer-gui versions 0.6.116.10
Description
The issue allows remote SMB servers to execute arbitrary commands via shell metacharacters in the (1) NetBIOS or (2) workgroup name, which are not properly handled when searching for network printers. This can lead to a violation of confidentiality, integrity, and availability of protected information. The exploitation of this issue can be carried out remotely.
Recommendations
For system-config-printer versions 0.6.x through 0.7.x, consider disabling the
pysmb.py function until a patch is available.
For system-config-printer-libs versions 0.7.32.10, restrict access to the vulnerable module to minimize the risk of exploitation.
For system-config-printer-gui versions 0.6.116.10, avoid using the NetBIOS or workgroup name in the affected API endpoint until the issue is resolved.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.RCE
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Red Hat
Smb
System-Config-Printer
System-Config-Printer-Gui
System-Config-Printer-Libs