CVE-2007-0161

The PML Driver HPZ12 (HPZipm12.exe) in the HP all-in-one drivers, as used by multiple HP products, uses insecure SERVICE_CHANGE_CONFIG DACL permissions, which allows local users to gain privileges and execute arbitrary programs, as demonstrated by modifying the binpath argument, a related issue to CVE-2006-0023.

Score

CVSS 2.0 4.1 Medium

Status

Modified - cve@mitre.org

Published

2007-01-10

Last modified

2024-08-07

Affected products

• Color Laserjet 4650 (Hp)
• Officejet 4100 (Hp)
• Officejet 5100 (Hp)
• Officejet 5500 (Hp)
• Officejet 6100 (Hp)
• Officejet 7100 (Hp)
• Officejet D (Hp)
• Officejet G (Hp)
• Officejet K (Hp)
• Pml Driver Hpz12 (Hp)
• Psc 1100 (Hp)
• Psc 1200 (Hp)
• Psc 1210 All-in-one (Hp)
• Psc 1300 (Hp)
• Psc 2100 (Hp)
• Psc 2200 (Hp)
• Psc 2400 Photosmart All-in-one (Hp)
• Psc 2500 Photosmart All-in-one (Hp)
• Psc 2510 Photosmart (Hp)
• Psc 700 (Hp)
• Psc 900 (Hp)

References

• http://osvdb.org/32654
• http://secunia.com/advisories/23663
• http://securityreason.com/securityalert/2128
• http://secway.org/advisory/AD20070108.txt
• http://www.securityfocus.com/archive/1/456259/100/0/threaded
• http://www.securityfocus.com/bid/21935
• http://www.vupen.com/english/advisories/2007/0094
• https://exchange.xforce.ibmcloud.com/vulnerabilities/31361