A vulnerability affecting HPLIP (HP Linux Imaging and Printing) software has been identified and patched in Ubuntu 15.04, Ubuntu 14.04 LTS, and Ubuntu 12.04 LTS.
[signoff icon=”icon-target”]HPLIP software is HP’s official solution for printing, scanning, and faxing with HP inkjet and laser printers on Linux. The HPLIP project provides support for 2432 printer models, including Deskjet, Officejet, Photosmart, PSC (Print Scan Copy), Business Inkjet, LaserJet, Edgeline MFP, and LaserJet MFP.[/signoff]
HPLIP may not be exactly a core component, but the major Linux include this software when installing the distributions.
The vulnerability in HPLIP can be exploited to obtain a different GPG key when performing plugin installations on the printer:
"Researcher Enrico Zini discovered that HPLIP was using a GPG-style short key ID when retrieving keys from the keyserver. An attacker could potentially exploit this by returning a different key with an identical short key ID and performing a man-in-the-middle attack during printer plugin installations," Canonical.
Users of affected distributions should upgrade their distribution to fix this security issue.
[alert variation=”alert-info”]The vulnerability can be successfully addressed by updating your system with the latest hplip-data package for your distribution. To apply the update, you can simply run the Update Manager application. Alternatively, you can open a terminal and type the following commands (you must be root):
sudo apt-get update
sudo apt-get dist-upgrade[/alert]
