Synopsis

Moderate: hplip security update

Type/Severity

Security Advisory: Moderate

Topic

Updated hplip packages that fix various security issues are now available
for Red Hat Enterprise Linux 5.

This update has been rated as having moderate security impact by the Red
Hat Security Response Team.

Description

The hplip (Hewlett-Packard Linux Imaging and Printing) packages provide
drivers for Hewlett-Packard printers and multifunction peripherals.

A flaw was discovered in the hplip alert-mailing functionality. A local
attacker could elevate their privileges by using specially-crafted packets
to trigger alert mails, which are sent by the root account. (CVE-2008-2940)

A flaw was discovered in the hpssd message parser. By sending
specially-crafted packets, a local attacker could cause a denial of
service, stopping the hpssd process. (CVE-2008-2941)

Users of hplip should upgrade to these updated packages, which contain
backported patches to correct these issues.

Solution

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.

This update is available via Red Hat Network. Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/FAQ_58_10188

Affected Products

• Red Hat Enterprise Linux Server 5 x86_64
• Red Hat Enterprise Linux Server 5 ia64
• Red Hat Enterprise Linux Server 5 i386
• Red Hat Enterprise Linux Server - Extended Update Support 5.2 x86_64
• Red Hat Enterprise Linux Server - Extended Update Support 5.2 ia64
• Red Hat Enterprise Linux Server - Extended Update Support 5.2 i386
• Red Hat Enterprise Linux Workstation 5 x86_64
• Red Hat Enterprise Linux Workstation 5 i386
• Red Hat Enterprise Linux Desktop 5 x86_64
• Red Hat Enterprise Linux Desktop 5 i386
• Red Hat Enterprise Linux for Power, big endian 5 ppc
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 5.2 ppc
• Red Hat Enterprise Linux Server from RHUI 5 x86_64
• Red Hat Enterprise Linux Server from RHUI 5 i386

Fixes

• BZ - 455235 - CVE-2008-2940 hpssd of hplip allows unprivileged user to trigger alert mail
• BZ - 457052 - CVE-2008-2941 hplip hpssd.py Denial-Of-Service parsing vulnerability

CVEs

• CVE-2008-2940
• CVE-2008-2941

References

• http://www.redhat.com/security/updates/classification/#moderate

Red Hat Enterprise Linux Server 5

SRPM
hplip-1.6.7-4.1.el5_2.4.src.rpm	SHA-256: a8309e80c0729372b177a95cfe7564d9e8575f4365bdf08995cd291a8d43f77a
x86_64
hpijs-1.6.7-4.1.el5_2.4.x86_64.rpm	SHA-256: 873d04135dae93f0ec30ca1c83b0ecf9f248240d5e26e916a8e8660b4e7569db
hplip-1.6.7-4.1.el5_2.4.x86_64.rpm	SHA-256: e10c3d34253293656e3d089c9242b3908f8a385df34d0f67c4f4034c3841f6fb
libsane-hpaio-1.6.7-4.1.el5_2.4.x86_64.rpm	SHA-256: 17f582c3ae10ca81b897a78c61eac2dfd676e130918b6e6360a51e0829852278
ia64
hpijs-1.6.7-4.1.el5_2.4.ia64.rpm	SHA-256: bd27c38f9acfaad466fe3645e279a4b4919d72c0551a585a64948d1ad80c11a8
hplip-1.6.7-4.1.el5_2.4.ia64.rpm	SHA-256: 667464e7273c486fe12a85e3160448c92e0c959f5e8f1fdfe883fbed97dfa9cd
libsane-hpaio-1.6.7-4.1.el5_2.4.ia64.rpm	SHA-256: 1c8075239eb154b4035b12a7d7521ffc85f8c96fe27641e4a6feac45e4f8d83d
i386
hpijs-1.6.7-4.1.el5_2.4.i386.rpm	SHA-256: e3500a594442bb1aaaa96b8f7f62d45b5bedd9dd0403c73ba2b8601f22838450
hplip-1.6.7-4.1.el5_2.4.i386.rpm	SHA-256: 154b014c0d87cdef7c8712a85ecd5acc522e5dccace73244ed0fe7bb46c5c0e4
libsane-hpaio-1.6.7-4.1.el5_2.4.i386.rpm	SHA-256: d4c9b57f7177425f4df195c92374d513f0c5054cef1bdc5321200d296781a16d

Red Hat Enterprise Linux Workstation 5

SRPM
hplip-1.6.7-4.1.el5_2.4.src.rpm	SHA-256: a8309e80c0729372b177a95cfe7564d9e8575f4365bdf08995cd291a8d43f77a
x86_64
hpijs-1.6.7-4.1.el5_2.4.x86_64.rpm	SHA-256: 873d04135dae93f0ec30ca1c83b0ecf9f248240d5e26e916a8e8660b4e7569db
hplip-1.6.7-4.1.el5_2.4.x86_64.rpm	SHA-256: e10c3d34253293656e3d089c9242b3908f8a385df34d0f67c4f4034c3841f6fb
libsane-hpaio-1.6.7-4.1.el5_2.4.x86_64.rpm	SHA-256: 17f582c3ae10ca81b897a78c61eac2dfd676e130918b6e6360a51e0829852278
i386
hpijs-1.6.7-4.1.el5_2.4.i386.rpm	SHA-256: e3500a594442bb1aaaa96b8f7f62d45b5bedd9dd0403c73ba2b8601f22838450
hplip-1.6.7-4.1.el5_2.4.i386.rpm	SHA-256: 154b014c0d87cdef7c8712a85ecd5acc522e5dccace73244ed0fe7bb46c5c0e4
libsane-hpaio-1.6.7-4.1.el5_2.4.i386.rpm	SHA-256: d4c9b57f7177425f4df195c92374d513f0c5054cef1bdc5321200d296781a16d

Red Hat Enterprise Linux Desktop 5

SRPM
hplip-1.6.7-4.1.el5_2.4.src.rpm	SHA-256: a8309e80c0729372b177a95cfe7564d9e8575f4365bdf08995cd291a8d43f77a
x86_64
hpijs-1.6.7-4.1.el5_2.4.x86_64.rpm	SHA-256: 873d04135dae93f0ec30ca1c83b0ecf9f248240d5e26e916a8e8660b4e7569db
hplip-1.6.7-4.1.el5_2.4.x86_64.rpm	SHA-256: e10c3d34253293656e3d089c9242b3908f8a385df34d0f67c4f4034c3841f6fb
libsane-hpaio-1.6.7-4.1.el5_2.4.x86_64.rpm	SHA-256: 17f582c3ae10ca81b897a78c61eac2dfd676e130918b6e6360a51e0829852278
i386
hpijs-1.6.7-4.1.el5_2.4.i386.rpm	SHA-256: e3500a594442bb1aaaa96b8f7f62d45b5bedd9dd0403c73ba2b8601f22838450
hplip-1.6.7-4.1.el5_2.4.i386.rpm	SHA-256: 154b014c0d87cdef7c8712a85ecd5acc522e5dccace73244ed0fe7bb46c5c0e4
libsane-hpaio-1.6.7-4.1.el5_2.4.i386.rpm	SHA-256: d4c9b57f7177425f4df195c92374d513f0c5054cef1bdc5321200d296781a16d

Red Hat Enterprise Linux for Power, big endian 5

SRPM
hplip-1.6.7-4.1.el5_2.4.src.rpm	SHA-256: a8309e80c0729372b177a95cfe7564d9e8575f4365bdf08995cd291a8d43f77a
ppc
hpijs-1.6.7-4.1.el5_2.4.ppc.rpm	SHA-256: c1527f8c3931fc5d7dd20c5f1411844b132402e8bd7352710a13ce974e6d8c0b
hplip-1.6.7-4.1.el5_2.4.ppc.rpm	SHA-256: f21a690e83692a98d9a51b0c5f0267d5666fcf24f10b2051f6b38044c7c23e9e
libsane-hpaio-1.6.7-4.1.el5_2.4.ppc.rpm	SHA-256: c708985584eefa6d85dfe22d5515856d187ba0d715f0e11b5bef488aa0e5e1f1

Red Hat Enterprise Linux Server from RHUI 5

SRPM
hplip-1.6.7-4.1.el5_2.4.src.rpm	SHA-256: a8309e80c0729372b177a95cfe7564d9e8575f4365bdf08995cd291a8d43f77a
x86_64
hpijs-1.6.7-4.1.el5_2.4.x86_64.rpm	SHA-256: 873d04135dae93f0ec30ca1c83b0ecf9f248240d5e26e916a8e8660b4e7569db
hplip-1.6.7-4.1.el5_2.4.x86_64.rpm	SHA-256: e10c3d34253293656e3d089c9242b3908f8a385df34d0f67c4f4034c3841f6fb
libsane-hpaio-1.6.7-4.1.el5_2.4.x86_64.rpm	SHA-256: 17f582c3ae10ca81b897a78c61eac2dfd676e130918b6e6360a51e0829852278
i386
hpijs-1.6.7-4.1.el5_2.4.i386.rpm	SHA-256: e3500a594442bb1aaaa96b8f7f62d45b5bedd9dd0403c73ba2b8601f22838450
hplip-1.6.7-4.1.el5_2.4.i386.rpm	SHA-256: 154b014c0d87cdef7c8712a85ecd5acc522e5dccace73244ed0fe7bb46c5c0e4
libsane-hpaio-1.6.7-4.1.el5_2.4.i386.rpm	SHA-256: d4c9b57f7177425f4df195c92374d513f0c5054cef1bdc5321200d296781a16d