lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date: Tue, 27 Mar 2007 18:22:51 +0000
From: "handrix cobra" <handrix@...il.com>
To: full-disclosure@...ts.grok.org.uk
Subject: Remote DOS HP JetDirect Print Servers

Vulnerability : Remote DOS HP JetDirect Print Servers
Product : HP JetDirect Print Servers "HP LaserJet Series"
By: Handrix <handrix_at_morx_org>
26 March 2007
MorX security research team
www.morx.org

+-------------+
| Description
:-------------------------------------------------------------------------------
+-------------+
|
| HP JetDirect print servers allow you to connect printers and other
| devices directly to a network.
|
| Such devices provide a variety of embeded services online, as like as ftp,
| snmp, web server, tftp ... and other daemon.
|
| However under a passive connection to the ftp's printers, and by sending a
RERT command
| with a big rang of data (271 to 277 char) as pathname, the ftp server turn
down,
| which cause the crash of the the engine.
+---------------------------------------------------------------------------------------------


+---------+
| Example
:-----------------------------------------------------------------------------------
+---------+
|
| % python /usr/lib/python2.4/ftplib.py -d [vulnerable host] -l -p `python
-c 'print "A"*300'`
+----------------------------------------------------------------------------------------------

+--------------------+
| Version vulnerable
:-----------------------------------------------------------------------
+--------------------+
|
| Hewlett-Packard FTP Print Server Version 2.4 and prior
+---------------------------------------------------------------------------------------------

+----------+
| Solution
:---------------------------------------------------------------------------------
+----------+
|
| Upgrade your drivers for your printers.
| By consulting the web page : http://www.hp.com/support/net_printing
+---------------------------------------------------------------------------------------------

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Powered by blists - more mailing lists