CVE-2013-6427
published 2013-12-09CVE-2013-6427: upgrade.py in the hp-upgrade service in HP Linux Imaging and Printing (HPLIP) 3.x through 3.13.11 launches a program from an http URL, which allows…
PriorityP338medium6.8CVSS 2.0
AVNACMAuNCPIPAP
EPSS
3.94%
89.1th percentile
upgrade.py in the hp-upgrade service in HP Linux Imaging and Printing (HPLIP) 3.x through 3.13.11 launches a program from an http URL, which allows man-in-the-middle attackers to execute arbitrary code by gaining control over the client-server data stream.
Affected
34 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | hplip | < hplip 3.13.11-2 (bookworm) | hplip 3.13.11-2 (bookworm) |
| hp | linux_imaging_and_printing_project | — | — |
| hp | linux_imaging_and_printing_project | — | — |
| hp | linux_imaging_and_printing_project | — | — |
| hp | linux_imaging_and_printing_project | — | — |
| hp | linux_imaging_and_printing_project | — | — |
| hp | linux_imaging_and_printing_project | — | — |
| hp | linux_imaging_and_printing_project | — | — |
| hp | linux_imaging_and_printing_project | — | — |
| hp | linux_imaging_and_printing_project | — | — |
| hp | linux_imaging_and_printing_project | — | — |
| hp | linux_imaging_and_printing_project | — | — |
| hp | linux_imaging_and_printing_project | — | — |
| hp | linux_imaging_and_printing_project | — | — |
| hp | linux_imaging_and_printing_project | — | — |
| hp | linux_imaging_and_printing_project | — | — |
| hp | linux_imaging_and_printing_project | — | — |
| hp | linux_imaging_and_printing_project | — | — |
| hp | linux_imaging_and_printing_project | — | — |
| hp | linux_imaging_and_printing_project | — | — |
| hp | linux_imaging_and_printing_project | — | — |
| hp | linux_imaging_and_printing_project | — | — |
| hp | linux_imaging_and_printing_project | — | — |
| hp | linux_imaging_and_printing_project | — | — |
| hp | linux_imaging_and_printing_project | — | — |
CVSS provenance
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
osv6.8MEDIUM
vendor_debian6.8MEDIUM
vendor_redhat6.8MEDIUM
vendor_ubuntu2.1LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
HPLIP vulnerabilities
vendor_ubuntu·2014-01-21·CVSS 2.1
CVE-2013-6402 [LOW] HPLIP vulnerabilities
Title: HPLIP vulnerabilities
Summary: Several security issues were fixed in HPLIP.
It was discovered that the HPLIP Polkit daemon incorrectly handled
temporary files. A local attacker could possibly use this issue to
overwrite arbitrary files. In the default installation of Ubuntu 12.04 LTS
and higher, this should be prevented by the Yama link restrictions.
(CVE-2013-6402)
It was discovered that HPLIP contained an upgrade tool that would download
code in an unsafe fashion. If a remote attacker were able to perform a
machine-in-the-middle attack, this flaw could be exploited to execute arbitrary
code. (CVE-2013-6427)
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
hplip: insecure auto update feature
vendor_redhat·2013-12-03·CVSS 6.8
CVE-2013-6427 [MEDIUM] hplip: insecure auto update feature
hplip: insecure auto update feature
upgrade.py in the hp-upgrade service in HP Linux Imaging and Printing (HPLIP) 3.x through 3.13.11 launches a program from an http URL, which allows man-in-the-middle attackers to execute arbitrary code by gaining control over the client-server data stream.
Statement: Not vulnerable. This issue did not affect the versions of hplip and hplip3 in Red Hat Enterprise Linux 5 and 6.
Package: hplip (Red Hat Enterprise Linux 5) - Not affected
Package: hplip3 (Red Hat Enterprise Linux 5) - Not affected
Package: hplip (Red Hat Enterprise Linux 6) - Not affected
Package: hplip (Red Hat Enterprise Linux 7) - Not affected
Debian
CVE-2013-6427: hplip - upgrade.py in the hp-upgrade service in HP Linux Imaging and Printing (HPLIP) 3....
vendor_debian·2013·CVSS 6.8
CVE-2013-6427 [MEDIUM] CVE-2013-6427: hplip - upgrade.py in the hp-upgrade service in HP Linux Imaging and Printing (HPLIP) 3....
upgrade.py in the hp-upgrade service in HP Linux Imaging and Printing (HPLIP) 3.x through 3.13.11 launches a program from an http URL, which allows man-in-the-middle attackers to execute arbitrary code by gaining control over the client-server data stream.
Scope: local
bookworm: resolved (fixed in 3.13.11-2)
bullseye: resolved (fixed in 3.13.11-2)
sid: resolved (fixed in 3.13.11-2)
trixie: resolved (fixed in 3.13.11-2)
GHSA
GHSA-p8g8-g88f-96q3: upgrade
ghsa_unreviewed·2022-05-17
CVE-2013-6427 [MEDIUM] CWE-94 GHSA-p8g8-g88f-96q3: upgrade
upgrade.py in the hp-upgrade service in HP Linux Imaging and Printing (HPLIP) 3.x through 3.13.11 launches a program from an http URL, which allows man-in-the-middle attackers to execute arbitrary code by gaining control over the client-server data stream.
OSV
CVE-2013-6427: upgrade
osv·2013-12-09·CVSS 6.8
CVE-2013-6427 [MEDIUM] CVE-2013-6427: upgrade
upgrade.py in the hp-upgrade service in HP Linux Imaging and Printing (HPLIP) 3.x through 3.13.11 launches a program from an http URL, which allows man-in-the-middle attackers to execute arbitrary code by gaining control over the client-server data stream.
No detection rules found.
No public exploits indexed.
http://lists.opensuse.org/opensuse-updates/2014-01/msg00087.htmlhttp://openwall.com/lists/oss-security/2013/12/05/2http://www.debian.org/security/2013/dsa-2829http://www.ubuntu.com/usn/USN-2085-1https://bugzilla.novell.com/show_bug.cgi?id=853405http://lists.opensuse.org/opensuse-updates/2014-01/msg00087.htmlhttp://openwall.com/lists/oss-security/2013/12/05/2http://www.debian.org/security/2013/dsa-2829http://www.ubuntu.com/usn/USN-2085-1https://bugzilla.novell.com/show_bug.cgi?id=853405
2013-12-09
Published