Vulnerability CVE-2013-0200
Published: 2013-03-06

Description:
HP Linux Imaging and Printing (HPLIP) through 3.12.4 allows local users to overwrite arbitrary files via a symlink attack on the (1) /tmp/hpcupsfilterc_#.bmp, (2) /tmp/hpcupsfilterk_#.bmp, (3) /tmp/hpcups_job#.out, (4) /tmp/hpijs_#####.out, or (5) /tmp/hpps_job#.out temporary file, a different vulnerability than CVE-2011-2722.

Type:

CWE-59

 (Improper Link Resolution Before File Access ('Link Following'))

CVSS2 => (AV:L/AC:M/Au:N/C:N/I:P/A:N)

CVSS Base Score
Impact Subscore
Exploitability Subscore
1.9/10
2.9/10
3.4/10
Exploit range
Attack complexity
Authentication
Local
Medium
No required
Confidentiality impact
Integrity impact
Availability impact
None
Partial
None
Affected software
Redhat -> Enterprise linux 
HP -> Linux imaging and printing project 

 References:
ftp://ftp.scientificlinux.org/linux/scientific/6x/SRPMS/vendor/hplip-3.12.4-4.el6.src.rpm
http://hplipopensource.com/hplip-web/release_notes.html
http://www.debian.org/security/2013/dsa-2829
http://www.mandriva.com/security/advisories?name=MDVSA-2013:088
http://www.ubuntu.com/usn/USN-1981-1
https://bugzilla.redhat.com/show_bug.cgi?id=902163
https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0072
Copyright 2024, cxsecurity.com

 

Back to Top