foomatic-rip-hplip in HP Linux Imaging and Printing (HPLIP) 3.11.5 allows remote attackers to execute arbitrary code via a crafted *FoomaticRIPCommandLine field in a .ppd file.

The remote Solaris system is missing necessary patches to address security updates :

  - foomatic-rip-hplip in HP Linux Imaging and Printing     (HPLIP) 3.11.5 allows remote attackers to execute     arbitrary code via a crafted *FoomaticRIPCommandLine     field in a .ppd file. (CVE-2011-2697)

  - foomaticrip.c in foomatic-rip in foomatic-filters in     Foomatic 4.0.6 allows remote attackers to execute     arbitrary code via a crafted *FoomaticRIPCommandLine     field in a .ppd file, a different vulnerability than     CVE-2011-2697. (CVE-2011-2964)

The foomatic print filters of the hplip package contained a remote code execution vulnerability. Remote users, if allowed to access a print server such as CUPS, could execute arbitrary commands as lp system user. CVE-2011-2964: CVSS v2 Base Score: 6.8 (moderate) (AV:N/AC:M/Au:N/C:P/I:P/A:P): Code Injection (CWE-94)

The remote Oracle Linux 5 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2011-1109 advisory.

    [3.0.2-38.3:.1]
    - Applied patch to fix improper sanitization of command line options       (CVE-2011-2697, bug #721001).

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Foomatic is a comprehensive, spooler-independent database of printers, printer drivers, and driver descriptions. The package also includes spooler-independent command line interfaces to manipulate queues and to print files and manipulate print jobs. foomatic-rip is a print filter written in Perl.

An input sanitization flaw was found in the foomatic-rip print filter.
An attacker could submit a print job with the username, title, or job options set to appear as a command line option that caused the filter to use a specified PostScript printer description (PPD) file, rather than the administrator-set one. This could lead to arbitrary code execution with the privileges of the 'lp' user. (CVE-2011-2697)

All foomatic users should upgrade to this updated package, which contains a backported patch to resolve this issue.

The remote host is affected by the vulnerability described in GLSA-201203-07 (foomatic-filters: User-assisted execution of arbitrary code)

    The foomatic-rip filter improperly handles command-line arguments,       including those issued by FoomaticRIPCommandLine fields in PPD files.
  Impact :

    A remote attacker could entice a user to open a specially crafted PPD       file, possibly resulting in execution of arbitrary code with the       privileges of the system user 'lp'.
  Workaround :

    There is no known workaround at this time.

It was discovered that the foomatic-filters, a support package for setting up printers, allowed authenticated users to submit crafted print jobs which would execute shell commands on the print servers.

 CVE-2011-2697 was assigned to the vulnerability in the Perl  implementation included in lenny, and CVE-2011-2964 to the  vulnerability affecting the C reimplementation part of squeeze.

The foomatic print filters of the hplip package contained a remote code execution vulnerability. Remote users, if allowed to access a print server such as CUPS, could execute arbitrary commands as lp system user.

CVE-2011-2697: CVSS v2 Base Score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P):
Input Validation (CWE-20)

This update of hplip fixes :

  - This patch originally affected foomatic-rip in CUPS but     was found to be in foomatic-rip-hplip too.
    (CVE-2004-0801: CVSS v2 Base Score: 7.5     (AV:N/AC:L/Au:N/C:P/I:P/A:P))

  - The foomatic print filters of the hplip package     contained a remote code execution vulnerability. Remote     users, if allowed to access a print server such as CUPS,     could execute arbitrary commands as lp system user.
    (CVE-2011-2697: CVSS v2 Base Score: 6.8     (AV:N/AC:M/Au:N/C:P/I:P/A:P))

It was discovered that the foomatic-rip Foomatic filter incorrectly handled command-line options. An attacker could use this flaw to cause Foomatic to execute arbitrary code as the 'lp' user.

In the default installation, attackers would be isolated by the CUPS AppArmor profile.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A vulnerability has been discovered and corrected in foomatic-filters :

foomatic-rip allows remote attackers to execute arbitrary code via a crafted *FoomaticRIPCommandLine field in a .ppd file (CVE-2011-2697, CVE-2011-2964).

Packages for 2009.0 are provided as of the Extended Maintenance Program. Please visit this link to learn more:
http://store.mandriva.com/product_info.php?cPath=149 products_id=490

The updated packages have been patched to correct this issue.

An updated foomatic package that fixes one security issue is now available for Red Hat Enterprise Linux 4 and 5.

The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

Foomatic is a comprehensive, spooler-independent database of printers, printer drivers, and driver descriptions. The package also includes spooler-independent command line interfaces to manipulate queues and to print files and manipulate print jobs. foomatic-rip is a print filter written in Perl.

An input sanitization flaw was found in the foomatic-rip print filter.
An attacker could submit a print job with the username, title, or job options set to appear as a command line option that caused the filter to use a specified PostScript printer description (PPD) file, rather than the administrator-set one. This could lead to arbitrary code execution with the privileges of the 'lp' user. (CVE-2011-2697)

All foomatic users should upgrade to this updated package, which contains a backported patch to resolve this issue.

The foomatic print filters of the hplip package contained a remote code execution vulnerability. Remote users, if allowed to access a print server such as CUPS, could execute arbitrary commands as lp system user.

  - CVE-2011-2697: CVSS v2 Base Score: 6.8     (AV:N/AC:M/Au:N/C:P/I:P/A:P) : Input Validation (CWE-20)

The foomatic print filters of the hplip package contained a remote code execution vulnerability. Remote users, if allowed to access a print server such as CUPS, could execute arbitrary commands as lp system user.

  - CVSS v2 Base Score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P):
    Input Validation (CWE-20). (CVE-2011-2697)

ID	Name	Product	Family	Severity
80613	Oracle Solaris Third-Party Patch Update : foomatic (multiple_vulnerabilities_in_foomatic)	Nessus	Solaris Local Security Checks	medium
75843	openSUSE Security Update : foomatic-filters (openSUSE-SU-2011:0892-1)	Nessus	SuSE Local Security Checks	medium
75503	openSUSE Security Update : foomatic-filters (openSUSE-SU-2011:0892-1)	Nessus	SuSE Local Security Checks	medium
68319	Oracle Linux 5 : foomatic (ELSA-2011-1109)	Nessus	Oracle Linux Local Security Checks	critical
61103	Scientific Linux Security Update : foomatic on SL4.x, SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
58217	GLSA-201203-07 : foomatic-filters: User-assisted execution of arbitrary code	Nessus	Gentoo Local Security Checks	medium
57520	Debian DSA-2380-1 : foomatic-filters - shell command injection	Nessus	Debian Local Security Checks	medium
57196	SuSE 10 Security Update : foomatic-filters (ZYPP Patch Number 7677)	Nessus	SuSE Local Security Checks	medium
55981	SuSE 11.1 Security Update : hplip (SAT Patch Number 4989)	Nessus	SuSE Local Security Checks	high
55957	Ubuntu 8.04 LTS / 10.04 LTS / 10.10 / 11.04 : foomatic-filters vulnerabilities (USN-1194-1)	Nessus	Ubuntu Local Security Checks	medium
55849	Mandriva Linux Security Advisory : foomatic-filters (MDVSA-2011:125)	Nessus	Mandriva Local Security Checks	medium
55839	CentOS 4 / 5 : foomatic (CESA-2011:1109)	Nessus	CentOS Local Security Checks	medium
55830	SuSE 10 Security Update : foomatic-filters (ZYPP Patch Number 7676)	Nessus	SuSE Local Security Checks	medium
55829	SuSE 11.1 Security Update : foomatic-filters (SAT Patch Number 4966)	Nessus	SuSE Local Security Checks	medium
55826	SuSE9 Security Update : foomatic-filters (YOU Patch Number 12818)	Nessus	SuSE Local Security Checks	medium
55755	RHEL 4 / 5 : foomatic (RHSA-2011:1109)	Nessus	Red Hat Local Security Checks	medium

Detections

Analytics

CVE-2011-2697

critical

Tenable Plugins

medium

medium

medium

critical

medium

medium

medium

medium

high

medium

medium

medium

medium

medium

medium

medium