full-disclosure - DDIVRT-2011-37 HP JetDirect Device Page Directory Traversal (CVE-2011-4785)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Mon, 9 Jan 2012 09:08:02 -0600
From: ddivulnalert <ddivulnalert@...frontline.com>
To: <full-disclosure@...ts.grok.org.uk>
Subject: DDIVRT-2011-37 HP JetDirect Device Page Directory
	Traversal (CVE-2011-4785)

Title: DDIVRT-2011-37 HP JetDirect Device Page Directory Traversal (CVE-2011-4785)
Severity: High
Date Discovered: 2011-10-12
Discovered By: Digital Defense, Inc. Vulnerability Research Team
Credited To: sxkeebler and r@...$

Vulnerability Description: 

The HP-ChaiSOE/1.0 embedded web server on certain HP JetDirect
printers allows a potential attacker to gain read only access to
directories and files outside of the web root, different from
CVE-2008-4419. An attacker can leverage this flaw to read arbitrary
system configuration files, cached documents, etc.  Information
obtained from an affected host may facilitate further attacks against
the host. Exploitation of this flaw is trivial using common web server
directory traversal techniques.

Solution Description: 

At this time, the vendor has been notified of the vulnerability and has
released a patch which addresses the issue for HP LaserJet P3015.

https://h20565.www2.hp.com/portal/site/hpsc/public/kb/docDisplay/?docId=emr_na-c03140700

Tested Systems / Software:
HP LaserJet 4650
Current Firmware: 20070419 07.006.0

HP LaserJet P3015
Current Firmware: 20100518 07.050.8 (Outdated)

HP LaserJet 2430
Current Firmware: 20090624 08.113.0_I35128

Vendor Name: HP
Vendor Website: http://www.hp.com/
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/