CVE-2009-0122 : hplip.postinst in HP Linux Imaging and Printing (HPLIP) 2.7.7 and 2.8.2 on Ubuntu allows local users to change the owner

hplip.postinst in HP Linux Imaging and Printing (HPLIP) 2.7.7 and 2.8.2 on Ubuntu allows local users to change the ownership of arbitrary files via unspecified manipulations in advance of an HPLIP installation or upgrade by an administrator, related to the product's attempt to correct the ownership of its configuration files within home directories.

Published 2009-01-15 17:30:00

Updated 2009-01-31 06:54:38

Source MITRE

View at NVD, CVE.org

Exploit prediction scoring system (EPSS) score for CVE-2009-0122

Probability of exploitation activity in the next 30 days: 0.04%

Percentile, the proportion of vulnerabilities that are scored at or less: ~ 6 % EPSS Score History EPSS FAQ

CVSS scores for CVE-2009-0122

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
6.9	MEDIUM	AV:L/AC:M/Au:N/C:C/I:C/A:C	3.4	10.0	NIST
Access Vector: Local Access Complexity: Medium Authentication: None Confidentiality Impact: Complete Integrity Impact: Complete Availability Impact: Complete

CWE ids for CVE-2009-0122

CWE-264

Assigned by: nvd@nist.gov (Primary)

Vendor statements for CVE-2009-0122

Red Hat 2009-01-19

Not vulnerable. This issue did not affect the versions of hplip as shipped with Red Hat Enterprise Linux 5.

References for CVE-2009-0122

http://www.ubuntu.com/usn/usn-708-1
http://www.securityfocus.com/bid/33249

Patch
https://launchpad.net/bugs/191299

Exploit

Products affected by CVE-2009-0122