Bug 455235 - (CVE-2008-2940) CVE-2008-2940 hpssd of hplip allows unprivileged user to trigger alert mail
CVE-2008-2940 hpssd of hplip allows unprivileged user to trigger alert mail
Status: CLOSED ERRATA
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
medium Severity medium
: ---
: ---
Assigned To: Red Hat Product Security
impact=moderate,source=redhat,reporte...
: Security, ZStream
Depends On: 455236 455237 458989 458990 458991
Blocks:
  Show dependency treegraph
 
Reported: 2008-07-14 06:26 EDT by Marc Schoenefeld
Modified: 2016-06-17 17:09 EDT (History)
8 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2008-09-11 11:14:50 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)
hplip-validate-uri.patch (633 bytes, patch)
2008-07-29 10:50 EDT, Tim Waugh
no flags Details | Diff
hplip-static-alerts-table.patch (1.99 KB, patch)
2008-07-29 10:51 EDT, Tim Waugh
no flags Details | Diff


External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2008:0818 normal SHIPPED_LIVE Moderate: hplip security update 2008-08-12 16:16:27 EDT

  None (edit)
Comment 2 Marc Schoenefeld 2008-07-14 08:45:31 EDT
==Description==

hpssd allows unprivileged local users to trigger alert mails 
by sending specially crafted packets
Comment 3 Tim Waugh 2008-07-29 10:50:21 EDT
Created attachment 312878 [details]
hplip-validate-uri.patch

This is the first of two patches to address this problem.  This patch performs
validation on the device URI when handling an 'event' message, and improves the
validation code.
Comment 4 Tim Waugh 2008-07-29 10:51:42 EDT
Created attachment 312880 [details]
hplip-static-alerts-table.patch

This is the second patch, which implements a static alerts table, stored in
/etc/hp/alerts.conf.  The 'setalerts' message now has no effect.
Comment 9 Josh Bressers 2008-08-12 16:11:10 EDT
Lifting embargo
Comment 11 Red Hat Product Security 2008-09-11 11:14:50 EDT
This issue was addressed in:

Red Hat Enterprise Linux:
  http://rhn.redhat.com/errata/RHSA-2008-0818.html

Note You need to log in before you can comment on or make changes to this bug.