FYI...
-
http://h20000.www2.h...ectID=c03102449Last Updated: 2011-12-23 Version: 2 (rev.2)
23 December 2011 Code signing firmware available
___
HP LaserJet printers - firmware access vuln-
http://www.securityt....com/id/1026357CVE Reference: CVE-2011-4161
Updated: Dec 1 2011
Impact: Execution of arbitrary code via network, Root access via network
Vendor Confirmed: Yes
Description: A vulnerability was reported in some HP LaserJet Printers. A remote user can update the firmware with arbitrary code. A remote user can send a specially crafted print job or specially crafted data to TCP port 9100 on the target printer to trigger an unspecified flaw and cause the printer to upgrade its firmware with arbitrary code. Some printers do not check digital signatures on firmware upgrades...
The original advisory is available at:
http://redtape.msnbc.msn.com/_news/2011/11/29/9076395-exclusive-millions-of-printers-open-to-devastating-hack-attack-researchers-say
Impact: A remote user can upgrade the printer's firmware with arbitrary code.
Solution: ... The vendor recommends disabling the 'Printer Firmware Update' feature as described at:
http://h71028.www7.hp.com/enterprise/downloads/HP-Imaging10.pdf
The vendor's advisory is available at:
http://h20565.www2.hp.com/portal/site/hpsc/public/kb/docDisplay/?docId=emr_na-c03102449
Last Updated: 2011-11-30
-
http://web.nvd.nist....d=CVE-2011-4161Last revised: 12/02/2011
CVSS v2 Base Score:
10.0 (HIGH)-
https://secunia.com/advisories/47063/Release Date: 2011-12-01
Criticality level: Moderately critical
Impact: Security Bypass ...
-
https://isc.sans.edu...l?storyid=12112Last Updated: 2011-11-29 16:22:00 UTC
-
http://h-online.com/-138737430 November 2011
___
-
http://www.hp.com/hp...11/111129b.htmlNov. 29, 2011 - "... Today there has been sensational and inaccurate reporting regarding a potential security vulnerability with some HP LaserJet printers.
No customer has reported unauthorized access. Speculation regarding potential for devices to catch fire due to a firmware change is false. HP LaserJet printers have a hardware element called a “thermal breaker” that is designed to prevent the fuser from overheating or causing a fire. It cannot be overcome by a firmware change or this proposed vulnerability. While HP has identified a potential security vulnerability with some HP LaserJet printers, no customer has reported unauthorized access. The specific vulnerability exists for some HP LaserJet devices if placed on a public internet
without a firewall. In a private network, some printers may be vulnerable if a malicious effort is made to modify the firmware of the device by a trusted party on the network. In some Linux or Mac environments, it may be possible for a specially formatted corrupt print job to trigger a firmware upgrade.
HP is building a firmware upgrade to mitigate this issue and will be communicating this proactively to customers and partners who may be impacted. In the meantime, HP reiterates its recommendation to follow best practices for securing devices by placing printers behind a firewall and, where possible, disabling remote firmware upload on exposed printers..."
Edited by AplusWebMaster, 02 January 2012 - 09:45 AM.
