USN-2699-1: HPLIP vulnerability

30 July 2015

hplip vulnerability

A security issue affects these releases of Ubuntu and its derivatives:

  • Ubuntu 15.04
  • Ubuntu 14.04 LTS
  • Ubuntu 12.04 LTS

Summary

HPLIP could be tricked into downloading a different GPG key when performing printer plugin installations.

Software Description

  • hplip - HP Linux Printing and Imaging System (HPLIP)

Details

Enrico Zini discovered that HPLIP used a short GPG key ID when downloading keys from the keyserver. An attacker could possibly use this to return a different key with a duplicate short key id and perform a man-in-the-middle attack on printer plugin installations.

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 15.04
hplip-data - 3.15.2-0ubuntu4.2
Ubuntu 14.04 LTS
hplip-data - 3.14.3-0ubuntu3.4
Ubuntu 12.04 LTS
hplip-data - 3.12.2-1ubuntu3.5

To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.

In general, a standard system update will make all the necessary changes.

References