full-disclosure - [ MDKSA-2007:201 ] - Updated hplip packages fix vulnerabilities

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-id: <E1Ik8wT-0006Kd-Be@artemis.annvix.ca>
Date: Mon, 22 Oct 2007 19:52:25 -0600
From: security@...driva.com
To: full-disclosure@...ts.grok.org.uk
Subject: [ MDKSA-2007:201 ] - Updated hplip packages fix
	vulnerabilities


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________
 
 Mandriva Linux Security Advisory                         MDKSA-2007:201
 http://www.mandriva.com/security/
 _______________________________________________________________________
 
 Package : hplip
 Date    : October 22, 2007
 Affected: 2007.0, 2007.1, 2008.0, Corporate 4.0
 _______________________________________________________________________
 
 Problem Description:
 
 A vulnerability in the hpssd tool was discovered where it did not
 correctly handle shell meta-characters.  A local attacker could use
 this flaw to execute arbitrary commands as the hplip user.
 
 As well, this update fixes a problem with some HP scanners on Mandriva
 Linux 2007.1, particularly HP PSC 1315, which wouldn't be detected
 and also fixes a problem with HP 1220 and possibly other models when
 scanning via the OpenOffice.org suite.
 
 Updated packages have been patched to prevent these issues.
 _______________________________________________________________________

 References:
 
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5208
 http://qa.mandriva.com/show_bug.cgi?id=28669
 http://qa.mandriva.com/show_bug.cgi?id=30719
 _______________________________________________________________________
 
 Updated Packages:
 
 Mandriva Linux 2007.0:
 299f2491535547a8c31047547c30a374  2007.0/i586/hplip-1.6.9-1.1mdv2007.0.i586.rpm
 466199e8246ac5bbb313fd4993d70bf2  2007.0/i586/hplip-hpijs-1.6.9-1.1mdv2007.0.i586.rpm
 2244889c2bd7f270df27343142d3f62e  2007.0/i586/hplip-hpijs-ppds-1.6.9-1.1mdv2007.0.i586.rpm
 41c25c58e970090ce4d40f36c0068138  2007.0/i586/hplip-model-data-1.6.9-1.1mdv2007.0.i586.rpm
 8f7bcb7fa03eea5dbdd1f77ce0dabb60  2007.0/i586/libhpip0-1.6.9-1.1mdv2007.0.i586.rpm
 e6d65bd872a05366e9561dd6f55edf61  2007.0/i586/libhpip0-devel-1.6.9-1.1mdv2007.0.i586.rpm
 856ab7370c5ee2522a28dedf1a5f4ab3  2007.0/i586/libsane-hpaio1-1.6.9-1.1mdv2007.0.i586.rpm 
 4e5ab4d4da6e8050b478a0bb265f185e  2007.0/SRPMS/hplip-1.6.9-1.1mdv2007.0.src.rpm

 Mandriva Linux 2007.0/X86_64:
 7dbf6c7630f64155962506d669c8f86b  2007.0/x86_64/hplip-1.6.9-1.1mdv2007.0.x86_64.rpm
 e41eca285e2612a28693bfeb38db7582  2007.0/x86_64/hplip-hpijs-1.6.9-1.1mdv2007.0.x86_64.rpm
 6436d68462becda088383a864aea768c  2007.0/x86_64/hplip-hpijs-ppds-1.6.9-1.1mdv2007.0.x86_64.rpm
 723e6deb7b02c29f7b93600ab165237b  2007.0/x86_64/hplip-model-data-1.6.9-1.1mdv2007.0.x86_64.rpm
 fc5cc7bb5f33b62d7c2c252090d28f26  2007.0/x86_64/lib64hpip0-1.6.9-1.1mdv2007.0.x86_64.rpm
 58bfc0c955530a49be5dd00da5e76fbb  2007.0/x86_64/lib64hpip0-devel-1.6.9-1.1mdv2007.0.x86_64.rpm
 af9a2efc2ce1084bb670a0a4e293a4c9  2007.0/x86_64/lib64sane-hpaio1-1.6.9-1.1mdv2007.0.x86_64.rpm 
 4e5ab4d4da6e8050b478a0bb265f185e  2007.0/SRPMS/hplip-1.6.9-1.1mdv2007.0.src.rpm

 Mandriva Linux 2007.1:
 a6b33bf46a7f78268ddb007f689edd23  2007.1/i586/hplip-2.7.7-7.1mdv2007.1.i586.rpm
 28e5e8aff4105d52126b8732e90cadf1  2007.1/i586/hplip-doc-2.7.7-7.1mdv2007.1.i586.rpm
 d806cde0fdcb8fe9d46640ab2271795d  2007.1/i586/hplip-hpijs-2.7.7-7.1mdv2007.1.i586.rpm
 c27544b840ddf59a82c0697db5b4cd32  2007.1/i586/hplip-hpijs-ppds-2.7.7-7.1mdv2007.1.i586.rpm
 d295506bc92eff1b5581ad37e04e5a68  2007.1/i586/hplip-model-data-2.7.7-7.1mdv2007.1.i586.rpm
 10a99416666a03079ed387bcee74ce80  2007.1/i586/libhpip0-2.7.7-7.1mdv2007.1.i586.rpm
 27a2755550ee7191a62751ec99cb719f  2007.1/i586/libhpip0-devel-2.7.7-7.1mdv2007.1.i586.rpm
 e583be3527d370980488f5f78d1b7362  2007.1/i586/libsane-hpaio1-2.7.7-7.1mdv2007.1.i586.rpm 
 452c3521b28c09698fe7e19026827874  2007.1/SRPMS/hplip-2.7.7-7.1mdv2007.1.src.rpm

 Mandriva Linux 2007.1/X86_64:
 4dc92ef5ab778ecd7661a510a2e202ca  2007.1/x86_64/hplip-2.7.7-7.1mdv2007.1.x86_64.rpm
 d81779825ff546a4da4badd8a5556bdc  2007.1/x86_64/hplip-doc-2.7.7-7.1mdv2007.1.x86_64.rpm
 ffe82f1e7726d7dfed351bc60216fadc  2007.1/x86_64/hplip-hpijs-2.7.7-7.1mdv2007.1.x86_64.rpm
 e35bf35488bea202e59a8fbfc7383aff  2007.1/x86_64/hplip-hpijs-ppds-2.7.7-7.1mdv2007.1.x86_64.rpm
 24fa0b0693fc01c1e3693d793b24b35a  2007.1/x86_64/hplip-model-data-2.7.7-7.1mdv2007.1.x86_64.rpm
 fb0e6fe41d2317f594020c3c71f5f3ba  2007.1/x86_64/lib64hpip0-2.7.7-7.1mdv2007.1.x86_64.rpm
 6e4712f70b98998a9bb2e1c1934ba9dc  2007.1/x86_64/lib64hpip0-devel-2.7.7-7.1mdv2007.1.x86_64.rpm
 87dcadb1b297fc41ec0a5e8c1a2a1a67  2007.1/x86_64/lib64sane-hpaio1-2.7.7-7.1mdv2007.1.x86_64.rpm 
 452c3521b28c09698fe7e19026827874  2007.1/SRPMS/hplip-2.7.7-7.1mdv2007.1.src.rpm

 Mandriva Linux 2008.0:
 0c90a3351c4c00a666280eff3f7bf7d2  2008.0/i586/hplip-2.7.7-8.1mdv2008.0.i586.rpm
 212ab21c2301c49e4feb164bff7770d8  2008.0/i586/hplip-doc-2.7.7-8.1mdv2008.0.i586.rpm
 23fa4660a68cc597879f90aacdaef8b6  2008.0/i586/hplip-hpijs-2.7.7-8.1mdv2008.0.i586.rpm
 41a48568c0e5e5778de17b4abdd96634  2008.0/i586/hplip-hpijs-ppds-2.7.7-8.1mdv2008.0.i586.rpm
 953c9014fb7093211f0cbf5692a489c8  2008.0/i586/hplip-model-data-2.7.7-8.1mdv2008.0.i586.rpm
 d7c87b86485ae7b23cbb78c9e19d30f0  2008.0/i586/libhpip0-2.7.7-8.1mdv2008.0.i586.rpm
 50593238a5a5cdd22dd385d52dfe440a  2008.0/i586/libhpip0-devel-2.7.7-8.1mdv2008.0.i586.rpm
 53bbb3cfc1b252d27d67835198618951  2008.0/i586/libsane-hpaio1-2.7.7-8.1mdv2008.0.i586.rpm 
 0688297afeaa5c8fb02659fb5548e2e0  2008.0/SRPMS/hplip-2.7.7-8.1mdv2008.0.src.rpm

 Mandriva Linux 2008.0/X86_64:
 b2174cb0a9f0566059a9791c0cfe30e3  2008.0/x86_64/hplip-2.7.7-8.1mdv2008.0.x86_64.rpm
 b2d1403450fb191b0c41ce5ce1b16172  2008.0/x86_64/hplip-doc-2.7.7-8.1mdv2008.0.x86_64.rpm
 1358e2423a1eb5f5fd116c34f7d21b36  2008.0/x86_64/hplip-hpijs-2.7.7-8.1mdv2008.0.x86_64.rpm
 f6b8950ac8b94e4ce3acac765c9c4699  2008.0/x86_64/hplip-hpijs-ppds-2.7.7-8.1mdv2008.0.x86_64.rpm
 f2f50dbabb9d619ab169e28e55c18c66  2008.0/x86_64/hplip-model-data-2.7.7-8.1mdv2008.0.x86_64.rpm
 b18aa425d5cef2815044d0a2c06f06b0  2008.0/x86_64/lib64hpip0-2.7.7-8.1mdv2008.0.x86_64.rpm
 c09cd479422f14a164f6daff3a106e00  2008.0/x86_64/lib64hpip0-devel-2.7.7-8.1mdv2008.0.x86_64.rpm
 e27d7faa1e618ff467a4e50c380c7f3b  2008.0/x86_64/lib64sane-hpaio1-2.7.7-8.1mdv2008.0.x86_64.rpm 
 0688297afeaa5c8fb02659fb5548e2e0  2008.0/SRPMS/hplip-2.7.7-8.1mdv2008.0.src.rpm

 Corporate 4.0:
 9e53fb82a52956138a75bcaaf1ba7737  corporate/4.0/i586/hplip-1.6.7-2.1.20060mlcs4.i586.rpm
 657b7c524b1fc298417fd5c59bbbe0e9  corporate/4.0/i586/hplip-hpijs-1.6.7-2.1.20060mlcs4.i586.rpm
 e6ad7fd9f757505067dfdd1ffb8fd2e4  corporate/4.0/i586/hplip-hpijs-ppds-1.6.7-2.1.20060mlcs4.i586.rpm
 2d96a52c37b2fc1b76244cde9e220727  corporate/4.0/i586/hplip-model-data-1.6.7-2.1.20060mlcs4.i586.rpm
 1992cf05eb0fd87b8b04f6761a08eecf  corporate/4.0/i586/libhpip0-1.6.7-2.1.20060mlcs4.i586.rpm
 18384c122ec43e4c600d54d1d763d179  corporate/4.0/i586/libhpip0-devel-1.6.7-2.1.20060mlcs4.i586.rpm
 3c0c95262df3e2a56a6f95705463e7a8  corporate/4.0/i586/libsane-hpaio1-1.6.7-2.1.20060mlcs4.i586.rpm 
 70e6cd75ad4712b1bc3302da3261b132  corporate/4.0/SRPMS/hplip-1.6.7-2.1.20060mlcs4.src.rpm

 Corporate 4.0/X86_64:
 41374a1ef2b9cf25721fe182dae2251e  corporate/4.0/x86_64/hplip-1.6.7-2.1.20060mlcs4.x86_64.rpm
 c7a950d5a616dccc688cdf942ef9a669  corporate/4.0/x86_64/hplip-hpijs-1.6.7-2.1.20060mlcs4.x86_64.rpm
 f102bea95bf3671e606e33582cf8f5b7  corporate/4.0/x86_64/hplip-hpijs-ppds-1.6.7-2.1.20060mlcs4.x86_64.rpm
 27c44674a3e70e4b4c39cb0cda4a5824  corporate/4.0/x86_64/hplip-model-data-1.6.7-2.1.20060mlcs4.x86_64.rpm
 deb89257aa15b07f1890c2d5f572f8dd  corporate/4.0/x86_64/lib64hpip0-1.6.7-2.1.20060mlcs4.x86_64.rpm
 653098db0848cc9ecfcf5421cfda08c0  corporate/4.0/x86_64/lib64hpip0-devel-1.6.7-2.1.20060mlcs4.x86_64.rpm
 eab54d31f392b41e18323f2a75358f2b  corporate/4.0/x86_64/lib64sane-hpaio1-1.6.7-2.1.20060mlcs4.x86_64.rpm 
 70e6cd75ad4712b1bc3302da3261b132  corporate/4.0/SRPMS/hplip-1.6.7-2.1.20060mlcs4.src.rpm
 _______________________________________________________________________

 To upgrade automatically use MandrivaUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandriva for security.  You can obtain the
 GPG public key of the Mandriva Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 You can view other update advisories for Mandriva Linux at:

  http://www.mandriva.com/security/advisories

 If you want to report vulnerabilities, please contact

  security_(at)_mandriva.com
 _______________________________________________________________________

 Type Bits/KeyID     Date       User ID
 pub  1024D/22458A98 2000-07-10 Mandriva Security Team
  <security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (GNU/Linux)

iD8DBQFHHSjBmqjQ0CJFipgRAuxhAKDAFuRQjk4Mgd46ZdYbv9Q+vo7WPgCePSru
LaKofbXgIW6Gpj8hA+PdHxo=
=eWSb
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/