Bug 1006674 (CVE-2013-4325)

Summary: CVE-2013-4325 hplip: Insecure calling of polkit
Product: [Other] Security Response Reporter: Huzaifa S. Sidhpurwala <huzaifas>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: jkurik, security-response-team, twaugh
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2015-08-23 13:34:37 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1005139, 1007171, 1007172, 1009541    
Bug Blocks: 1002376    
Attachments:
Description Flags
hplip patch none

Description Huzaifa S. Sidhpurwala 2013-09-11 05:37:53 UTC 
Sebastian Krahmer reported a security issue was found in polkit (CVE-2013-4288 bz 1002375).

It was found that hplip was vulnerable to this issue as well, since it communicated to polkit authority using an unsafe DBUS interface. 

This issue has been assigned CVE-2013-4325
Comment 1 Huzaifa S. Sidhpurwala 2013-09-11 06:01:32 UTC 
Created attachment 796256 [details]
hplip patch
Comment 3 Vincent Danen 2013-09-18 15:14:03 UTC 
This is now public:

http://www.openwall.com/lists/oss-security/2013/09/18/4
Comment 4 Vincent Danen 2013-09-18 15:26:52 UTC 
Created hplip tracking bugs for this issue:

Affects: fedora-all [bug 1009541]
Comment 5 errata-xmlrpc 2013-09-19 18:06:49 UTC 
This issue has been addressed in following products:

  Red Hat Enterprise Linux 6

Via RHSA-2013:1274 https://rhn.redhat.com/errata/RHSA-2013-1274.html
Comment 6 Fedora Update System 2013-09-20 04:01:42 UTC 
hplip-3.13.9-2.fc19 has been pushed to the Fedora 19 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 7 Fedora Update System 2013-09-20 16:24:48 UTC 
hplip-3.13.9-2.fc19 has been pushed to the Fedora 19 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 8 Fedora Update System 2013-10-09 14:50:07 UTC 
hplip-3.13.9-2.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 9 Fedora Update System 2013-10-18 20:03:35 UTC 
hplip-3.13.9-2.fc18 has been pushed to the Fedora 18 stable repository.  If problems still persist, please make note of it in this bug report.