NetSight
IP …
medium6.9

CVE-2013-4325

The check_permission_v1 function in base/pkit.py in HP Linux Imaging and Printing (HPLIP) through 3.13.9 does not properly use D-Bus for communication with a p…

Impact

The check_permission_v1 function in base/pkit.py in HP Linux Imaging and Printing (HPLIP) through 3.13.9 does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a (1) setuid process or (2) pkexec process.

Affected products

VendorProductAffected versions
HpLinux Imaging And Printing Project
Versions 1.0, 2.0, 2.7.10, 3.9.2, 3.9.4, 3.9.4b

Weakness classification

CWE-264

References