GLSA Advocate
Joined: 12 May 2004 Posts: 2663
|
Posted: Tue Mar 06, 2012 7:26 am Post subject: [ GLSA 201203-07 ] foomatic-filters: User-assisted execution |
|
|
Gentoo Linux Security Advisory
Title: foomatic-filters: User-assisted execution of arbitrary code (GLSA 201203-07)
Severity: normal
Exploitable: remote
Date: March 06, 2012
Bug(s): #379559
ID: 201203-07
Synopsis
A vulnerability in foomatic-filters could result in the execution
of arbitrary code.
Background
The foomatic-filters package contains wrapper scripts which are designed
to be used with Foomatic.
Affected Packages
Package: net-print/foomatic-filters
Vulnerable: < 4.0.9
Unaffected: >= 4.0.9
Architectures: All supported architectures
Description
The foomatic-rip filter improperly handles command-line arguments,
including those issued by FoomaticRIPCommandLine fields in PPD files.
Impact
A remote attacker could entice a user to open a specially crafted PPD
file, possibly resulting in execution of arbitrary code with the
privileges of the system user "lp".
Workaround
There is no known workaround at this time.
Resolution
All foomatic-filters users should upgrade to the latest version: Code: | # emerge --sync
# emerge --ask --oneshot --verbose
">=net-print/foomatic-filters-4.0.9"
|
References
CVE-2011-2697
CVE-2011-2964 |
|