Vulnerabilities in SANE Backends and HPLIP

This directory contains two proof-of-concept exploits for several vulnerabilities in SANE Backends.

The first PoC, fakescanner.cpp, is an enumeration of the different vulnerabilities listed in the bug report. Run it like this:

make
./fakescanner epson 0

(There are different command-line options for triggering different bugs.) On a different computer, start Simple Scan.

The second PoC, sane_backends_exploit.cpp, is a more elaborate exploit which uses a subset of the vulnerabilities to pop a calculator. It is designed to target Simple Scan on Ubuntu 18.04 LTS. It will not work on more recent Ubuntu versions due to the glibc version being different. Run it like this:

make
./sane_backends_exploit

On a different computer, start Simple Scan.