bugtraq - RE: Canon ImageRunner reveals SMB, IPX, and FTP username/passwords

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Thu, 28 Sep 2006 09:08:33 -0400
From: "Jill George" <jgeorge@...t.org>
To: <gunrnr@...thlink.net>, <bugtraq@...urityfocus.com>
Subject: RE: Canon ImageRunner reveals SMB, IPX, and FTP username/passwords

Our vendor (reseller) provided this fix:

Go to service mode level 2
Copier/Option/User/CTM-S06  set from 0 to 1.   By changing this setting
in copier there will be no passwords exposed, but when you import into
another unit a password will have to be entered at the new location.

Their tech executed this on our Canon ImageRunner 4570. The "pwd:" line that
used to display the SMB password no longer appears in the exported address
book (although the username line still appears). Assume it would work on
other models.

-- Jill George

-----Original Message-----
From: gunrnr@...thlink.net [mailto:gunrnr@...thlink.net]
Sent: Tuesday, September 05, 2006 7:11 PM
To: bugtraq@...urityfocus.com
Subject: Canon ImageRunner reveals SMB, IPX, and FTP username/passwords

The Canon ImageRunner multi-function devices Remote UI web interface
software will reveal username and password pairs contained in address book
entries when the address book is exported.  These address book entries are
used for scanning to SMB, FTP, or IPX shares.  In addition, passwords for
password protected fax entries will be revealed.

This security flaw was brought to Canon's attention through its vendor Ikon.
Canon's recommendation is to enable the system manager ID to restrict access
to the web interface.  However, this is a limited security measure for if
there are users that have access to that portion of the web interface but
shouldn't have access to the usernames and passwords stored in the device,
this will not protect against such.  Also, if the system manager ID and
password is compromised it will make accessible the user names and password
pairs stored on the device.

Tested and verified on Canon iR C3220, iR 5020, iR9070, iR C6800, iR C6870,
and iR 8500.  Also, machines running the Fiery software have the same
exploit as the Fiery software works in conjunction with the Remote UI
software.  As the Remote UI software is the same across many machines, it is
likely that the problem exists in all devices running Remote UI.

Following is an example of an exported address book:

===
# Canon AddressBook version: 1
# CharSet: WCP1252
# SubAddressBookName:

dn: 201
cn: FTP address
cnread: FTP address
url: ftp.myftpserver.com
path: ftpdir/
username: foo
pwd: bar
accesscode: 0
protocol: ftp
objectclass: top
objectclass: extensibleobject
objectclass: remotefilesystem

dn: 202
cn: Fax address
cnread: Fax address
dialdata: 5551212
pwd: 123456789
txstartspeed: 33600
commode: domestic
lineselect: auto
faxprotocol: g4
accesscode: 0
protocol: t30
objectclass: top
objectclass: extensibleobject
objectclass: g3fax

dn: 203
cn: SMB address
cnread: SMB address
url: smb.mysmbserver.com
path: pathtoshare/
username: foo
pwd: bar
accesscode: 0
protocol: smb
objectclass: top
objectclass: extensibleobject
objectclass: remotefilesystem

dn: 204
cn: IPX Address
cnread: IPX Address
url: ipx.myipxserver.com
path: pathtoshare/
username: foo
pwd: bar
accesscode: 0
protocol: ipx
objectclass: top
objectclass: extensibleobject
objectclass: remotefilesystem
===

-GR