Multiple Canon Multifunction Printers FTP Bounce Vulnerability

Bugtraq ID:	28042
Class:	Design Error
CVE:	CVE-2008-0303
Remote:	Yes
Local:	No
Published:	Feb 28 2008 12:00AM
Updated:	Feb 29 2008 05:42PM
Credit:	Nate Johnson and the Indiana University are credited with discovering this vulnerability.
Vulnerable:	Canon imageRUNNER LBP5960 Canon imageRUNNER CLC5151 Canon imageRUNNER CLC4040 Canon imageRUNNER C6880i Canon imageRUNNER C6880 Canon imageRUNNER C6870i Canon imageRUNNER C6870 Canon imageRUNNER C5880i Canon imageRUNNER C5880 Canon imageRUNNER C5870i Canon imageRUNNER C5870 Canon imageRUNNER C5185i Canon imageRUNNER C4580i Canon imageRUNNER C4080i Canon imageRUNNER C3380i Canon imageRUNNER C3380 Canon imageRUNNER C3220N Canon imageRUNNER C3220 Canon imageRUNNER C2880i Canon imageRUNNER C2880 Canon imageRUNNER C2620N Canon imageRUNNER C2620 Canon imageRUNNER C2380i Canon imageRUNNER 9070 Canon imageRUNNER 85+ Canon imageRUNNER 8070 Canon imageRUNNER 7105 Canon imageRUNNER 7095P Canon imageRUNNER 7095 Canon imageRUNNER 7086 Canon imageRUNNER 6800CN Canon imageRUNNER 6800C Canon imageRUNNER 6570 Canon imageRUNNER 5800CN Canon imageRUNNER 5800C Canon imageRUNNER 5570 Canon imageRUNNER 5075N Canon imageRUNNER 5075 Canon imageRUNNER 5065N Canon imageRUNNER 5065 Canon imageRUNNER 5055N Canon imageRUNNER 5055 Canon imageRUNNER 4570 Canon imageRUNNER 3570 Canon imageRUNNER 3530 Canon imageRUNNER 3180Ci Canon imageRUNNER 3180C Canon imageRUNNER 3170Ci Canon imageRUNNER 3170C Canon imageRUNNER 3045N Canon imageRUNNER 3045 Canon imageRUNNER 3035N Canon imageRUNNER 3035 Canon imageRUNNER 3025N Canon imageRUNNER 3025 Canon imageRUNNER 2870 Canon imageRUNNER 2570Ci Canon imageRUNNER 2570C Canon imageRUNNER 2270 Canon imageRUNNER 2230 Canon imageRUNNER 105+ Canon imagePRESS C1 Canon i-SENSYS LBP5360 Canon i-SENSYS LBP3460 Canon i-SENSYS LBP3360
Not Vulnerable:

Multiple Canon Multifunction Printers FTP Bounce Vulnerability

Multiple Canon multifunction printers are affected by an FTP-bounce vulnerability that can allow remote attackers to connect between the FTP server and an arbitrary port on another computer.

Successful exploits may allow an attacker to connect to arbitrary hosts and generate traffic with the identity of the vulnerable FTP server.

Multiple Canon Multifunction Printers FTP Bounce Vulnerability

An attacker uses readily available network tools to exploit this issue.

Multiple Canon Multifunction Printers FTP Bounce Vulnerability

References:

• Canon Homepage (Canon)
  
• Indiana University Security Advisory: 20080229 Canon MFD FTP bounce attack (Indiana University )
  
• VU#568073 Canon digital multifunction copiers FTP bounce vulnerability (US-CERT)
  
• Web Advisory: Digital multifunction printer vulnerability (Canon)