Bug 492712 – <net-print/hplip-3.14.1 : insecure temporary file handling in pkit.py (CVE-2013-6402)

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Agostino Sarubbo 2013-11-27 17:17:34 UTC]

From ${URL} :

A temporary file handling flaw was found in hplip/pkit.py. Because a predicatable temporary filename is 
used, an attacker could use a symlink attack to overwrite an arbitrary file with the privileges of the 
process running hplip.

This is a different flaw than CVE-2013-0200.

References:
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=725876
https://bugzilla.novell.com/show_bug.cgi?id=852368


@maintainer(s): after the bump, in case we need to stabilize the package, please let us know if it is ready for the stabilization or not.

[Comment 1 Daniel Pielmeier 2014-01-10 19:57:52 UTC]

I have bumped hplip to 3.14.1 which should fix the issue.
Stabilization for 3.13.9 is currently in the works (bug #484474). I will close this one and open a new one for 3.14.1.

[Comment 2 Yury German 2014-01-10 19:59:56 UTC]

(In reply to Daniel Pielmeier from comment #1)
> I have bumped hplip to 3.14.1 which should fix the issue.
> Stabilization for 3.13.9 is currently in the works (bug #484474). I will
> close this one and open a new one for 3.14.1.

If you are stabilizing for security and the bug is fixed in version 3.14.1 we can stabilize as part of this bug when you are ready.

[Comment 3 GLSAMaker/CVETool Bot 2014-01-11 17:57:23 UTC]

CVE-2013-6402 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-6402):
  base/pkit.py in HP Linux Imaging and Printing (HPLIP) through 3.13.11 allows
  local users to overwrite arbitrary files via a symlink attack on the
  /tmp/hp-pkservice.log temporary file.

[Comment 4 GLSAMaker/CVETool Bot 2014-01-11 17:57:25 UTC]

CVE-2013-6402 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-6402):
  base/pkit.py in HP Linux Imaging and Printing (HPLIP) through 3.13.11 allows
  local users to overwrite arbitrary files via a symlink attack on the
  /tmp/hp-pkservice.log temporary file.

[Comment 5 Manuel Rüger (RETIRED) 2015-08-16 02:20:33 UTC]

Fixed versions have been stabilized. Vulnerable versions have been removed.

@ glsa coordinators: Please vote.

[Comment 6 Stefan Behte (RETIRED) 2015-11-09 22:01:24 UTC]

Vote: NO.

[Comment 7 Kristian Fiskerstrand (RETIRED) 2015-11-09 22:24:46 UTC]

GLSA Vote: No