Canon ImageRUNNER 5000 Printer Email Printing Vulnerability

Bugtraq ID:	11247
Class:	Access Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Sep 24 2004 12:00AM
Updated:	Sep 24 2004 12:00AM
Credit:	Discovery of this issue is credited to Andrew Daviel <[email protected]>.
Vulnerable:	Canon imageRUNNER IR5000i
Not Vulnerable:

Canon ImageRUNNER 5000 Printer Email Printing Vulnerability

The Canon imageRUNNER printer is a network based printer and photocopier designed to facilitate all small office printing requirements.

Canon imageRUNNER 5000 is reportedly vulnerable to an email printing vulnerability. This issue is due to an access validation issue that fails to require authorization to have emails printed.

Reportedly it is impossible to disable the vulnerable email server feature.

An attacker may leverage this issue to print arbitrary text on an affected printer, potentially consuming resources and triggering a denial of service condition.

Canon ImageRUNNER 5000 Printer Email Printing Vulnerability

No exploit is required to leverage this issue.

Canon ImageRUNNER 5000 Printer Email Printing Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Canon ImageRUNNER 5000 Printer Email Printing Vulnerability

References:

• Canon Homepage (Canon)
  
• Canon ImageRunner reveals SMB, IPX, and FTP username/passwords ([email protected])