Canon ImageRunner 信息泄露漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1193564 漏洞类型 访问验证错误
发布时间 2006-09-11 更新时间 2006-09-12
CVE编号 CVE-2006-4680 CNNVD-ID CNNVD-200609-145
漏洞平台 N/A CVSS评分 4.0
|漏洞来源
https://cxsecurity.com/issue/WLB-2006090066
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200609-145
|漏洞详情
CanonimageRUNNER中的远程UI在导出地址簿时会包含用户名和密码,这可让依赖于上下文的攻击者获取敏感信息。
|漏洞EXP
gunrnr (at) earthlink (dot) net [email concealed] wrote:
> The Canon ImageRunner multi-function device?s Remote UI web interface software will reveal username and password pairs contained in address book entries when the address book is exported.  These address book entries are used for scanning to SMB, FTP, or IPX shares.  In addition, passwords for password protected fax entries will be revealed.  
>
> This security flaw was brought to Canon's attention through its vendor Ikon.  Canon's recommendation is to enable the system manager ID to restrict access to the web interface.  However, this is a limited security measure for if there are users that have access to that portion of the web interface but shouldn't have access to the usernames and passwords stored in the device, this will not protect against such.  Also, if the system manager ID and password is compromised it will make accessible the user names and password pairs stored on the device.
>
> Tested and verified on Canon iR C3220, iR 5020, iR9070, iR C6800, iR C6870, and iR 8500.  Also, machines running the Fiery software have the same exploit as the Fiery software works in conjunction with the Remote UI software.  As the Remote UI software is the same across many machines, it is likely that the problem exists in all devices running Remote UI.
>
> Following is an example of an exported address book:
>
> ===
> # Canon AddressBook version: 1
> # CharSet: WCP1252
> # SubAddressBookName: 
>
> dn: 201
> cn: FTP address
> cnread: FTP address
> url: ftp.myftpserver.com
> path: ftpdir/
> username: foo
> pwd: bar
> accesscode: 0
> protocol: ftp
> objectclass: top
> objectclass: extensibleobject
> objectclass: remotefilesystem
>
> dn: 202
> cn: Fax address
> cnread: Fax address
> dialdata: 5551212
> pwd: 123456789
> txstartspeed: 33600
> commode: domestic
> lineselect: auto
> faxprotocol: g4
> accesscode: 0
> protocol: t30
> objectclass: top
> objectclass: extensibleobject
> objectclass: g3fax
>
> dn: 203
> cn: SMB address
> cnread: SMB address
> url: smb.mysmbserver.com
> path: pathtoshare/
> username: foo
> pwd: bar
> accesscode: 0
> protocol: smb
> objectclass: top
> objectclass: extensibleobject
> objectclass: remotefilesystem
>
> dn: 204
> cn: IPX Address
> cnread: IPX Address
> url: ipx.myipxserver.com
> path: pathtoshare/
> username: foo
> pwd: bar
> accesscode: 0
> protocol: ipx
> objectclass: top
> objectclass: extensibleobject
> objectclass: remotefilesystem
> ===
>
> -GR
Tested and verified on an iR 2620.
|参考资料

来源:BID
名称:19865
链接:http://www.securityfocus.com/bid/19865
来源:BUGTRAQ
名称:20060907Re:CanonImageRunnerrevealsSMB,IPX,andFTPusername/passwords
链接:http://www.securityfocus.com/archive/1/archive/1/445532/100/0/threaded
来源:BUGTRAQ
名称:20060905CanonImageRunnerrevealsSMB,IPX,andFTPusername/passwords
链接:http://www.securityfocus.com/archive/1/archive/1/445302/100/0/threaded
来源:VUPEN
名称:ADV-2006-3501
链接:http://www.frsirt.com/english/advisories/2006/3501
来源:SECUNIA
名称:21788
链接:http://secunia.com/advisories/21788
来源:XF
名称:canon-imagerunner-information-disclosure(28795)
链接:http://xforce.iss.net/xforce/xfdb/28795
来源:SREASON
名称:1538
链接:http://securityreason.com/securityalert/1538