Vulnerability Details : CVE-2013-0200
HP Linux Imaging and Printing (HPLIP) through 3.12.4 allows local users to overwrite arbitrary files via a symlink attack on the (1) /tmp/hpcupsfilterc_#.bmp, (2) /tmp/hpcupsfilterk_#.bmp, (3) /tmp/hpcups_job#.out, (4) /tmp/hpijs_#####.out, or (5) /tmp/hpps_job#.out temporary file, a different vulnerability than CVE-2011-2722.
Exploit prediction scoring system (EPSS) score for CVE-2013-0200
Probability of exploitation activity in the next 30 days: 0.04%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 6 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2013-0200
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
---|---|---|---|---|---|
1.9
|
LOW | AV:L/AC:M/Au:N/C:N/I:P/A:N |
3.4
|
2.9
|
NIST |
CWE ids for CVE-2013-0200
-
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.Assigned by: nvd@nist.gov (Primary)
References for CVE-2013-0200
-
http://hplipopensource.com/hplip-web/release_notes.html
hp's Developer Portal | HP Linux Imaging and Printing
-
http://www.mandriva.com/security/advisories?name=MDVSA-2013:088
mandriva.com
-
http://www.debian.org/security/2013/dsa-2829
Debian -- Security Information -- DSA-2829-1 hplip
-
https://bugzilla.redhat.com/show_bug.cgi?id=902163
902163 – (CVE-2013-0200) CVE-2013-0200 hplip: insecure temporary file handling flaws
-
https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0072
Support/Advisories/MGASA-2013-0072 - Mageia wiki
-
ftp://ftp.scientificlinux.org/linux/scientific/6x/SRPMS/vendor/hplip-3.12.4-4.el6.src.rpm
Patch
-
http://www.ubuntu.com/usn/USN-1981-1
USN-1981-1: HPLIP vulnerabilities | Ubuntu security notices
Products affected by CVE-2013-0200
- cpe:2.3:a:hp:linux_imaging_and_printing_project:*:*:*:*:*:*:*:*
- cpe:2.3:a:hp:linux_imaging_and_printing_project:1.0:*:*:*:*:*:*:*
- cpe:2.3:a:hp:linux_imaging_and_printing_project:3.10.9:*:*:*:*:*:*:*
- cpe:2.3:a:hp:linux_imaging_and_printing_project:3.9.8:*:*:*:*:*:*:*
- cpe:2.3:a:hp:linux_imaging_and_printing_project:3.11.5:*:*:*:*:*:*:*
- cpe:2.3:a:hp:linux_imaging_and_printing_project:3.11.3:*:*:*:*:*:*:*
- cpe:2.3:a:hp:linux_imaging_and_printing_project:3.11.1:*:*:*:*:*:*:*
- cpe:2.3:a:hp:linux_imaging_and_printing_project:3.9.4b:*:*:*:*:*:*:*
- cpe:2.3:a:hp:linux_imaging_and_printing_project:3.9.4:*:*:*:*:*:*:*
- cpe:2.3:a:hp:linux_imaging_and_printing_project:3.11.7:*:*:*:*:*:*:*
- cpe:2.3:a:hp:linux_imaging_and_printing_project:3.11.3a:*:*:*:*:*:*:*
- cpe:2.3:a:hp:linux_imaging_and_printing_project:3.9.10:*:*:*:*:*:*:*
- cpe:2.3:a:hp:linux_imaging_and_printing_project:3.9.6:*:*:*:*:*:*:*
- cpe:2.3:a:hp:linux_imaging_and_printing_project:3.10.6:*:*:*:*:*:*:*
- cpe:2.3:a:hp:linux_imaging_and_printing_project:3.10.5:*:*:*:*:*:*:*
- cpe:2.3:a:hp:linux_imaging_and_printing_project:3.9.2:*:*:*:*:*:*:*
- cpe:2.3:a:hp:linux_imaging_and_printing_project:3.10.2:*:*:*:*:*:*:*
- cpe:2.3:a:hp:linux_imaging_and_printing_project:3.9.12:*:*:*:*:*:*:*
- cpe:2.3:a:hp:linux_imaging_and_printing_project:2.7.10:*:*:*:*:*:*:*
- cpe:2.3:a:hp:linux_imaging_and_printing_project:2.0:*:*:*:*:*:*:*
- cpe:2.3:a:hp:linux_imaging_and_printing_project:3.11.10:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*