| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <20090204144223.22107.qmail@securityfocus.com> Date: 4 Feb 2009 14:42:23 -0000 From: vulnerabilityresearch@...frontline.com To: bugtraq@...urityfocus.com Subject: DDIVRT-2008-19 HP JetDirect Web Administration Directory Traversal Title ----- DDIVRT-2008-19 HP JetDirect Web Administration Directory Traversal Severity -------- High Date Discovered --------------- October 23, 2008 Discovered By ------------- Digital Defense, Inc. Vulnerability Research Team Credit: Shmoov and r@...$ Vulnerability Description ------------------------- The HP-ChaiSOE/1.0 embedded web server on certain HP JetDirect printers allows a potential attacker to gain read only access to directories and files outside of the web root. An attacker can leverage this flaw to read arbitrary system configuration files, cached documents, etc. Information obtained from an affected host may facilitate further attacks against the host. Exploitation of this flaw is trivial using common web server directory traversal techniques. Solution Description -------------------- The vendor has released an update. See http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01623905 for more details. Digital Defense, Inc. recommends restricting access to the HP JetDirect web administration interface to authorized hosts only. Tested Systems / Software (with versions) ------------------------------------------ Embedded web server HP-ChaiSOE/1.0 on: HP JetDirect 2420 HP JetDirect 4250 Vendor Contact -------------- HP http://www.hp.com
Powered by blists - more mailing lists