35 matches found
hplip -- hpssd Denial of Service
Secunia reports: A security issue has been reported in hplip, which can be exploited by malicious, local users to cause a DoS. The security issue is caused due to an error within hpssd.py when parsing certain requests. This can be exploited to crash the service by sending specially crafted reques...
hplip security update
1.6.7-4.1.el52.4 - Applied patch to make hpssd message parser more robust bug 457052. - Applied patches to fix insecure alert emails bug 455235...
SuSE 10 Security Update : hplip17 and hplip17-hpijs (ZYPP Patch Number 4507)
The deamon 'hpssd' could be exploited by users to execute arbitrary commands as root. hpssd only runs on systems that have HP all-in-one devices configured. In the default configuration the problem is not remotely exploitable as hpssd only listens on local interfaces. CVE-2007-5208 %NASLMINLEVEL...
Ubuntu 6.10 / 7.04 : hplip vulnerability (USN-530-1)
It was discovered that the hpssd tool of hplip did not correctly handle shell meta-characters. A local attacker could exploit this to execute arbitrary commands as the hplip user. Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security...
Fedora 7 : hplip-1.7.4a-6.fc7 (2007-2527)
This update fixes a vulnerability in the hpssd daemon. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues...
Mandrake Linux Security Advisory : hplip (MDKSA-2007:201)
A vulnerability in the hpssd tool was discovered where it did not correctly handle shell meta-characters. A local attacker could use this flaw to execute arbitrary commands as the hplip user. As well, this update fixes a problem with some HP scanners on Mandriva Linux 2007.1, particularly HP PSC...
GLSA-200710-26 : HPLIP: Privilege escalation
The remote host is affected by the vulnerability described in GLSA-200710-26 HPLIP: Privilege escalation Kees Cook from the Ubuntu Security team discovered that the hpssd daemon does not correctly validate user-supplied data before passing it to a 'popen3' call. Impact : A local attacker may be...
openSUSE 10 Security Update : hplip (hplip-4516)
The deamon 'hpssd' could be exploited by users to execute arbitrary commands as root. hpssd only runs on systems that have HP all-in-one devices configured. In the default configuration the problem is not remotely exploitable as hpssd only listens on local interfaces CVE-2007-5208. %NASLMINLEVEL...
HP Linux Imaging and Printing Project (hplip) hpssd from Address Command Injection
The version of the HP Linux Imaging and Printing System hpssd daemon on the remote host fails to sanitize user-supplied input before appending it to a commandline when calling sendmail. Using a specially crafted email address, an unauthenticated, remote attacker can leverage this issue to execute...
HP Linux Imaging and Printing System HPSSD Daemon Detection
The remote service is an hpssd daemon, a component of the HP Linux Imaging and Printing HPLIP System that provides various services to HPLIP client applications. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include"compat.inc"; if description scriptid2705...
CVE-2007-5208
hpssd in Hewlett-Packard Linux Imaging and Printing Project hplip 1.x and 2.x before 2.7.10 allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a from address, which is not properly handled when invoking sendmail...
CVE-2007-5208
hpssd in Hewlett-Packard Linux Imaging and Printing Project hplip 1.x and 2.x before 2.7.10 allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a from address, which is not properly handled when invoking sendmail...
CVE-2007-5208
CVE-2007-5208 affects the HP Linux Imaging and Printing Project (HPLIP) hpssd daemon. Affected: hplip 1.x and 2.x before 2.7.10. Description from multiple sources indicates that input handling of the From address during sendmail invocation allows context-dependent attackers to execute arbitrary c...
