Upstream information

CVE-2013-4325 at MITRE

Description

The check_permission_v1 function in base/pkit.py in HP Linux Imaging and Printing (HPLIP) through 3.13.9 does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a (1) setuid process or (2) pkexec process.

SUSE information

CVSS v2 Scores
  National Vulnerability Database
Base Score 6.89
Vector AV:L/AC:M/Au:N/C:C/I:C/A:C
Access Vector Local
Access Complexity Medium
Authentication None
Confidentiality Impact Complete
Integrity Impact Complete
Availability Impact Complete
SUSE Bugzilla entries: 808355 [RESOLVED / FIXED], 836931 [RESOLVED / FIXED], 836932 [RESOLVED / FIXED], 836937 [RESOLVED / FIXED], 852368 [RESOLVED / FIXED], 864716 [RESOLVED / FIXED]

SUSE Security Advisories:

List of released packages

Product(s) Fixed package version(s) References
SUSE Linux Enterprise Desktop 11 SP2
  • hplip >= 3.11.10-0.6.11.1
  • hplip-hpijs >= 3.11.10-0.6.11.1
Patchnames:
sledsp2-hplip
SUSE Linux Enterprise Desktop 11 SP3
  • hplip >= 3.11.10-0.6.11.1
  • hplip-hpijs >= 3.11.10-0.6.11.1
Patchnames:
sledsp3-hplip
SUSE Linux Enterprise Server 11 SP2
  • hplip >= 3.11.10-0.6.11.1
  • hplip-hpijs >= 3.11.10-0.6.11.1
Patchnames:
slessp2-hplip
SUSE Linux Enterprise Server 11 SP3
  • hplip >= 3.11.10-0.6.11.1
  • hplip-hpijs >= 3.11.10-0.6.11.1
Patchnames:
slessp3-hplip
SUSE Linux Enterprise Server for VMWare 11 SP2
  • hplip >= 3.11.10-0.6.11.1
  • hplip-hpijs >= 3.11.10-0.6.11.1
Patchnames:
slessp2-hplip
SUSE Linux Enterprise Server for VMWare 11 SP3
  • hplip >= 3.11.10-0.6.11.1
  • hplip-hpijs >= 3.11.10-0.6.11.1
Patchnames:
slessp3-hplip
SUSE Linux Enterprise Desktop 11 SP3
SUSE Linux Enterprise Server 11 SP3
SUSE Linux Enterprise Server 11 SP3 for VMware
  • hplip >= 3.11.10-0.6.11.1
  • hplip-hpijs >= 3.11.10-0.6.11.1
Builds
SAT Patch Nr: 8775
SUSE Linux Enterprise Desktop 11 SP2
SUSE Linux Enterprise Server 11 SP2
SUSE Linux Enterprise Server 11 SP2 for VMware
  • hplip >= 3.11.10-0.6.11.1
  • hplip-hpijs >= 3.11.10-0.6.11.1
Builds
SAT Patch Nr: 8777
openSUSE 12.3
  • hplip >= 3.12.11-2.5.1
  • hplip-debuginfo >= 3.12.11-2.5.1
  • hplip-debugsource >= 3.12.11-2.5.1
  • hplip-hpijs >= 3.12.11-2.5.1
  • hplip-hpijs-debuginfo >= 3.12.11-2.5.1
  • hplip-sane >= 3.12.11-2.5.1
  • hplip-sane-debuginfo >= 3.12.11-2.5.1
Patchnames:
openSUSE-2013-812
openSUSE Evergreen 11.4
  • hplip >= 3.11.5-1.15.1
  • hplip-debuginfo >= 3.11.5-1.15.1
  • hplip-debugsource >= 3.11.5-1.15.1
  • hplip-hpijs >= 3.11.5-1.15.1
  • hplip-hpijs-debuginfo >= 3.11.5-1.15.1
Patchnames:
2013-154