PT-2013-1080 · Hewlett Packard+4 · Hplip-Debuginfo+10
Sebastian Krahmer
·
Published
2013-03-06
·
Updated
2024-06-15
·
CVE-2013-4325
CVSS v2.0
6.9
Medium
| Vector | AV:L/AC:M/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
hplip versions prior to 3.14.1
hplip-gui versions 3.12.4
hplip-common versions 3.12.4
hplip-debuginfo versions 3.12.4
hplip-libs versions 3.12.4
libsane-hpaio versions 3.12.4
hpijs versions 3.12.4
Description
The issue is related to the
check permission v1 function in base/pkit.py which does not properly use D-Bus for communication with a polkit authority. This allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a setuid process or pkexec process. The exploitation of this issue may lead to a violation of confidentiality, integrity, and availability of protected information. It can be exploited locally.Recommendations
For hplip versions prior to 3.14.1, update to version 3.14.1 or later.
For hplip-gui versions 3.12.4, update to a version later than 3.12.4.
For hplip-common versions 3.12.4, update to a version later than 3.12.4.
For hplip-debuginfo versions 3.12.4, update to a version later than 3.12.4.
For hplip-libs versions 3.12.4, update to a version later than 3.12.4.
For libsane-hpaio versions 3.12.4, update to a version later than 3.12.4.
For hpijs versions 3.12.4, update to a version later than 3.12.4.
As a temporary workaround, consider disabling the
check permission v1 function until a patch is available. Restrict access to the polkit authority to minimize the risk of exploitation. Avoid using setuid processes or pkexec processes until the issue is resolved.Fix
Link Following
Race Condition
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Centos
Red Hat
Suse
Hpijs
Hplip
Hplip-Common
Hplip-Debuginfo
Hplip-Gui
Hplip-Libs
Libsane-Hpaio