hpssd vulnerable to command injection

[Kees Cook]

Binary package hint: hplip

hpssd calls sendmail via strings instead of via an array, and does no validation of from-network inputs. As a result, the "from_address" can be injected into hpssd, causing any local user to run commands as the invoker of hpssd.

[Kees Cook (kees)]

Fix for hpssd.py and scan.py (which also uses open3 instead of subprocess, though I did not check to see if scan's from_address is injectable)

[Kees Cook (kees)]

Dapper (0.x hplip) is not vulnerable. (This code was using SMTP directly.)

[Till Kamppeter (till-kamppeter)]

Fixed packages for Gutsy are on their way. Get the packages for immediate testing on

http://www.linux-foundation.org/~till/tmp/ubuntu/gutsy/hplip/

[Kees Cook (kees)]

This is CVE-2007-5208

[Till Kamppeter (till-kamppeter)]

Soory, fix withdrawn. We must wait for the other distros to also supply the fix. Kees Cook will take care of packaging and uploading it in time.

[Till Kamppeter (till-kamppeter)]

Subscribed upstream developers to this bug, so that upstream version gets also fixed.

[dwelch91 (dwelch91)]

Patch applied to HPLIP upstream version on tip. Will be in 2.7.10.

[Kees Cook (kees)]

http://www.ubuntu.com/usn/usn-530-1