Test ID:	1.3.6.1.4.1.25623.1.0.841690
Category:	Ubuntu Local Security Checks
Title:	Ubuntu: Security Advisory (USN-2085-1)
Summary:	The remote host is missing an update for the 'hplip' package(s) announced via the USN-2085-1 advisory.
Description:	Summary: The remote host is missing an update for the 'hplip' package(s) announced via the USN-2085-1 advisory. Vulnerability Insight: It was discovered that the HPLIP Polkit daemon incorrectly handled temporary files. A local attacker could possibly use this issue to overwrite arbitrary files. In the default installation of Ubuntu 12.04 LTS and higher, this should be prevented by the Yama link restrictions. (CVE-2013-6402) It was discovered that HPLIP contained an upgrade tool that would download code in an unsafe fashion. If a remote attacker were able to perform a machine-in-the-middle attack, this flaw could be exploited to execute arbitrary code. (CVE-2013-6427) Affected Software/OS: 'hplip' package(s) on Ubuntu 10.04, Ubuntu 12.04, Ubuntu 12.10, Ubuntu 13.10. Solution: Please install the updated package(s). CVSS Score: 6.8 CVSS Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2013-6402 DSA-2829 http://www.debian.org/security/2013/dsa-2829 USN-2085-1 http://www.ubuntu.com/usn/USN-2085-1 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=725876 https://bugzilla.novell.com/show_bug.cgi?id=852368 https://security-tracker.debian.org/tracker/CVE-2013-6402 openSUSE-SU-2014:0127 http://lists.opensuse.org/opensuse-updates/2014-01/msg00087.html openSUSE-SU-2014:0146 http://lists.opensuse.org/opensuse-updates/2014-01/msg00098.html Common Vulnerability Exposure (CVE) ID: CVE-2013-6427 [oss-security] 20131204 Re: CVE needed for hplip insecure auto update feature? http://openwall.com/lists/oss-security/2013/12/05/2 https://bugzilla.novell.com/show_bug.cgi?id=853405
Copyright	Copyright (C) 2014 Greenbone AG

This is only one of 146377 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.