oss-sec mailing list archives
[CVE-2015-0839] hp-plugin binary driver verification
From: Enrico Zini <enrico () enricozini org>
Date: Fri, 29 May 2015 15:00:35 +0200
Hello, background history: 2015-03-10: I reported this issue to the Debian security team 2015-03-12: The Debian security team assigned CVE-2015-0839 from the Debian pool 2015-03-16: I reported this issue upstream, privately, at https://bugs.launchpad.net/bugs/1432516 2015-05-29: There has been no reply from upstream so far, so I am making a public report. The issue: I was forced to run hp-plugin to download a binary driver for the new printer, and I noticed this bit: Downloading plug-in from: Receiving digital keys: /usr/bin/gpg --homedir /home/enrico/.hplip/.gnupg --no-permission-warning --keyserver pgp.mit.edu --recv-keys 0xA59047B9 Creating directory plugin_tmp Verifying archive integrity... All good. The use of a short key ID worries me, because it is now trivial to generate keys with arbitrary key IDs, and gpg --recv-keys will happily download all those it finds. Also, pgp.mit.edu is a keyserver where everyone can upload arbitrary keys. You can run "gpg --recv 70096AD1" to play with multiple keys having the same key ID. I assume hp-plugin is open to downloading and verifying plugins signed by any key that one can verify that have that short key ID, and that with that and some fiddling with DNS one can cause systems running hp-plugin to download and run malicious code. A quick fix would be to use the full fingerprint instead of the key id. Regards, Enrico -- GPG key: 4096R/E7AD5568 2009-05-08 Enrico Zini <enrico () enricozini org>
Attachment:
signature.asc
Description: Digital signature
Current thread:
- [CVE-2015-0839] hp-plugin binary driver verification Enrico Zini (May 29)
- Re: [CVE-2015-0839] hp-plugin binary driver verification Daniel Kahn Gillmor (May 31)