lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date: Tue, 19 Dec 2006 18:54:56 +0100
From: Joxean Koret <>
To: Full Disclosure <>,
Subject: HP Printers FTP Server Denial Of Service

HP FTP Printer Server Denial Of Service

Author: Joxean Koret
Date: 2006
Location: Basque Country 

Affected Software

Vendor: Hewlett Packard
Description: HP Printers FTP Server Denial Of Service


A problem exists in almost any currently used HP Printer with the FTP
Print Server.

Version 2.4 of the FTP Print Server will crash with only one shoot.
Version 2.4.5, which is latest, will need various shoots (the number of
shoots needed is currently unknow).

While playing with my own FTP Fuzzer I tried finding flaws in HP's
Printers. After trying with 5 printers I found the problem in all of
these. The problem is a buffer overflow in the LIST and NLST command. In
version 2.4 a single shoot sending a LIST command with a long string
(about 256 characters) is sufficient enough to test the vulnerability.

Take care trying it because two of my printers were crashed completely
(you will need to make use of your warranty ;] ). Against 2.4 versions
it can crash the complete printer and be unresponsive even after
rebooting it.

In version 2.4.5 (which is the latest) you need to send various times
long shoots to the parameter LIST (a single shoot will not crash,
printer will answer with a "Path too long" message). You will need to
send various times a LIST command with long strings. When trying with
other commands you will see that no problem is raised and the printer
will always be responsive. After a successfull attack you may completely
crash your printer (i.e., calling technical support to fix your crashed

The problem can be easily triggered by using any FTP fuzzing tool. You
can crash your printer in about 10 second(s) in a LAN.

The printer models I used in my tests are:

  * HP LaserJet 5000 Series (firmware R.25.15 / R.25.47)
  * HP LaserJet 5100 Series (firmware V.29.12)

Attached goes POCs for the vulnerabilities.


Disable the FTP print server as, surely, you aren't using it.


The information in this advisory and any of its demonstrations is
provided "as is" without any warranty of any kind.

I am not liable for any direct or indirect damages caused as a result of
using the information or demonstrations provided in any part of this


Joxean Koret < joxeankoret [at] yah00 [D0T] es >

Agian, agian, egün batez
jeikiko dira egiazko Ziberotarrak,
egiazko eüskaldünak,
tirano arrotzen hiltzeko 
eta gure aiten aitek ützi daikien 
lurraren popüliari erremetitzeko.

View attachment "" of type "text/x-python" (1260 bytes)

View attachment "" of type "text/x-python" (1243 bytes)

Download attachment "signature.asc" of type "application/pgp-signature" (190 bytes)

Full-Disclosure - We believe in it.
Hosted and sponsored by Secunia -

Powered by blists - more mailing lists