National Cyber Awareness System

Vulnerability Summary for CVE-2007-5208

Overview

hpssd in Hewlett-Packard Linux Imaging and Printing Project (hplip) 1.x and 2.x before 2.7.10 allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a from address, which is not properly handled when invoking sendmail.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: REDHAT

Name: RHSA-2007:0960

Type: Advisory; Patch Information

Hyperlink:http://www.redhat.com/support/errata/RHSA-2007-0960.html

External Source: MISC

Name: https://launchpad.net/bugs/149121

Hyperlink:https://launchpad.net/bugs/149121

External Source: CONFIRM

Name: https://bugzilla.redhat.com/show_bug.cgi?id=319921

Hyperlink:https://bugzilla.redhat.com/show_bug.cgi?id=319921

External Source: VUPEN

Name: ADV-2007-3479

Hyperlink:http://www.vupen.com/english/advisories/2007/3479

External Source: UBUNTU

Name: USN-530-1

Hyperlink:http://www.ubuntulinux.org/support/documentation/usn/usn-530-1

External Source: OVAL

Name: oval:org.mitre.oval:def:10692

Hyperlink:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:10692

External Source: FEDORA

Name: FEDORA-2007-2527

Hyperlink:https://www.redhat.com/archives/fedora-package-announce/2007-October/msg00200.html

External Source: XF

Name: hplip-hpssd-command-execution(37183)

Hyperlink:http://xforce.iss.net/xforce/xfdb/37183

External Source: SECTRACK

Name: 1018806

Hyperlink:http://www.securitytracker.com/id?1018806

External Source: BID

Name: 26054

Hyperlink:http://www.securityfocus.com/bid/26054

External Source: MANDRIVA

Name: MDKSA-2007:201

Hyperlink:http://www.mandriva.com/en/security/advisories?name=MDKSA-2007:201

External Source: DEBIAN

Name: DSA-1462

Hyperlink:http://www.debian.org/security/2008/dsa-1462

External Source: GENTOO

Name: GLSA-200710-26

Hyperlink:http://security.gentoo.org/glsa/glsa-200710-26.xml

External Source: SECUNIA

Name: 28453

Hyperlink:http://secunia.com/advisories/28453

External Source: SECUNIA

Name: 27397

Hyperlink:http://secunia.com/advisories/27397

External Source: SECUNIA

Name: 27332

Hyperlink:http://secunia.com/advisories/27332

External Source: SECUNIA

Name: 27271

Hyperlink:http://secunia.com/advisories/27271

External Source: SECUNIA

Name: 27232

Hyperlink:http://secunia.com/advisories/27232

External Source: SECUNIA

Name: 27224

Hyperlink:http://secunia.com/advisories/27224

External Source: SECUNIA

Name: 27221

Hyperlink:http://secunia.com/advisories/27221

External Source: SECUNIA

Name: 27202

Hyperlink:http://secunia.com/advisories/27202

External Source: CONFIRM

Name: http://qa.mandriva.com/show_bug.cgi?id=30719

Hyperlink:http://qa.mandriva.com/show_bug.cgi?id=30719

External Source: SUSE

Name: SUSE-SR:2007:021

Hyperlink:http://lists.opensuse.org/opensuse-security-announce/2007-10/msg00006.html

External Source: CONFIRM

Name: http://bugs.gentoo.org/show_bug.cgi?id=195565

Hyperlink:http://bugs.gentoo.org/show_bug.cgi?id=195565

References to Check Content

Identifier:oval:org.mitre.oval:def:10692

Check System:http://oval.mitre.org/XMLSchema/oval-definitions-5

Hyperlink:http://oval.mitre.org/repository/data/DownloadDefinition?id=oval:org.mitre.oval:def:10692