Fuji Xerox Printing Systems Print Engine FTP Bounce Vulnerability
BID:19711
Info
Fuji Xerox Printing Systems Print Engine FTP Bounce Vulnerability
| Bugtraq ID: | 19711 |
| Class: | Design Error |
| CVE: |
CVE-2006-2112 |
| Remote: | Yes |
| Local: | No |
| Published: | Aug 25 2006 12:00AM |
| Updated: | Oct 13 2006 09:49PM |
| Credit: | Nate Johnson and Sean Krulewitch are credited with discovering this vulnerability. |
| Vulnerable: |
Fuji Xerox Printing Systems Co. Phaser 6201J 0 Fuji Xerox Printing Systems Co. FXPS Print Engine (OEM) 0 Fuji Xerox Printing Systems Co. DocuPrint C830 Network Option Card 0 Fuji Xerox Printing Systems Co. DocuPrint C830 0 Fuji Xerox Printing Systems Co. DocuPrint C525A Network Option Card 0 Fuji Xerox Printing Systems Co. DocuPrint C525A 0 Fuji Xerox Printing Systems Co. DocuPrint C2535A 0 Fuji Xerox Printing Systems Co. DocuPrint C1616 Network Option Card 0 Fuji Xerox Printing Systems Co. DocuPrint C1616 0 Fuji Xerox Printing Systems Co. DocuPrint 211 Network Option Card 0 Fuji Xerox Printing Systems Co. DocuPrint 211 0 Fuji Xerox Printing Systems Co. DocuPrint 181 Network Option Card 0 Fuji Xerox Printing Systems Co. DocuPrint 181 0 Dell 5110cn 0 Dell 5100cn 0 Dell 3110cn 0 Dell 3100cn 0 Dell 3010cn 0 Dell 3000cn 0 Dell 3000cn 0 |
| Not Vulnerable: |
Fuji Xerox Printing Systems Co. Phaser 6201J 5.13 Fuji Xerox Printing Systems Co. DocuPrint C830 Network Option Card 5.13 Fuji Xerox Printing Systems Co. DocuPrint C525A Network Option Card 8.17 Fuji Xerox Printing Systems Co. DocuPrint C1616 Network Option Card 5.13 Fuji Xerox Printing Systems Co. DocuPrint 211 Network Option Card 5.13 Fuji Xerox Printing Systems Co. DocuPrint 181 Network Option Card 5.13 Dell 5110cn A01 Dell 5100cn A05 Dell 3110cn A01 Dell 3100cn A05 Dell 3010cn A01 Dell 3000cn A05 |
Discussion
Fuji Xerox Printing Systems Print Engine FTP Bounce Vulnerability
FXPS print engine is affected by an FTP-Bounce issue that can allow remote attackers to connect between the FTP server and an arbitrary port on another computer.
This could result in the proxying of arbitrary requests by a user through the system using the vulnerable FTP print server.
Successful exploits may allow an attacker to make connections to arbitrary hosts and generate traffic with the identity of the vulnerable FTP print server. As a result, this may allow the attacker to bypass access controls and security restrictions by masking the original source of the attacker's traffic.
FXPS print engine is affected by an FTP-Bounce issue that can allow remote attackers to connect between the FTP server and an arbitrary port on another computer.
This could result in the proxying of arbitrary requests by a user through the system using the vulnerable FTP print server.
Successful exploits may allow an attacker to make connections to arbitrary hosts and generate traffic with the identity of the vulnerable FTP print server. As a result, this may allow the attacker to bypass access controls and security restrictions by masking the original source of the attacker's traffic.
Exploit / POC
Fuji Xerox Printing Systems Print Engine FTP Bounce Vulnerability
An attacker uses standard network tools to exploit this issue.
An attacker uses standard network tools to exploit this issue.
Solution / Fix
Fuji Xerox Printing Systems Print Engine FTP Bounce Vulnerability
Solution:
The vendor has released updated firmware to address this issue.
Please see the references for more information.
Fuji Xerox Printing Systems Co. DocuPrint C830 0
Fuji Xerox Printing Systems Co. Phaser 6201J 0
Fuji Xerox Printing Systems Co. DocuPrint C525A Network Option Card 0
Fuji Xerox Printing Systems Co. DocuPrint C1616 0
Fuji Xerox Printing Systems Co. DocuPrint 181 0
Fuji Xerox Printing Systems Co. DocuPrint C525A 0
Fuji Xerox Printing Systems Co. DocuPrint 211 0
Fuji Xerox Printing Systems Co. DocuPrint C830 Network Option Card 0
Solution:
The vendor has released updated firmware to address this issue.
Please see the references for more information.
Fuji Xerox Printing Systems Co. DocuPrint C830 0
-
Fuji Xerox Printing Systems Co. C83F0607.EXE
http://download.fujixerox.co.jp/docuprint_c/download/830/fw.html
Fuji Xerox Printing Systems Co. Phaser 6201J 0
-
Fuji Xerox Printing Systems Co. 6201N513.EXE
http://www.fxpsc.co.jp/download/fw/fw_6201.html
Fuji Xerox Printing Systems Co. DocuPrint C525A Network Option Card 0
-
Fuji Xerox Printing Systems Co. N5250817.EXE
http://download.fujixerox.co.jp/docuprint_c/download/525a/nic_fw.html
Fuji Xerox Printing Systems Co. DocuPrint C1616 0
-
Fuji Xerox Printing Systems Co. C16F0607.EXE
http://download.fujixerox.co.jp/docuprint_c/download/1616/fw.html
Fuji Xerox Printing Systems Co. DocuPrint 181 0
-
Fuji Xerox Printing Systems Co. 181F0607.EXE
http://download.fujixerox.co.jp/docuprint/download/211series/181_firm. html
Fuji Xerox Printing Systems Co. DocuPrint C525A 0
-
Fuji Xerox Printing Systems Co. C5250614.EXE
http://download.fujixerox.co.jp/docuprint_c/download/525a/fw.html
Fuji Xerox Printing Systems Co. DocuPrint 211 0
-
Fuji Xerox Printing Systems Co. 211F0607.EXE
http://download.fujixerox.co.jp/docuprint/download/211series/211_firm. html
Fuji Xerox Printing Systems Co. DocuPrint C830 Network Option Card 0
-
Fuji Xerox Printing Systems Co. C83N513.EXE
http://download.fujixerox.co.jp/docuprint_c/download/830/nic_fw.html
References
Fuji Xerox Printing Systems Print Engine FTP Bounce Vulnerability
References:
References:
- Dell Homepage (Dell)
- Fuji Xerox Printing Systems Co., Ltd. (FXPS) Homepage (Fuji Xerox Printing Systms Co. )
- ITSO Advisory: 20060824 FXPS Print Engine Vulnerabilities (ITSO)
- Indiana University Security Advisory: Fuji Xerox Printing Systems (FXPS) print e (Krulewitch, Sean V)