HP JetDirect JetAdmin Password Vulnerability
BID:3132
Info
HP JetDirect JetAdmin Password Vulnerability
| Bugtraq ID: | 3132 |
| Class: | Design Error |
| CVE: |
CVE-2001-1039 CVE-2001-1040 |
| Remote: | Yes |
| Local: | No |
| Published: | Aug 01 2001 12:00AM |
| Updated: | Jul 11 2009 07:56AM |
| Credit: | This vulnerability was submitted to BugTraq on August 1st, 2001 by Will Backman <[email protected]>. |
| Vulnerable: |
HP JetAdmin 6.2 HP JetAdmin 6.1 HP JetAdmin 6.0 HP JetAdmin 5.6 HP JetAdmin 5.5.177 HP JetAdmin 5.5 HP JetAdmin 5.1 HP JetAdmin 4.1.2 HP JetAdmin 4.0 |
| Not Vulnerable: | |
Discussion
HP JetDirect JetAdmin Password Vulnerability
HP JetDirect JetAdmin is the installation and management software for HP's line of commercial print servers.
HP JetDirect devices configured using the JetAdmin web interface do not set a password for telnet access when the administrator password is chosen. As a result, the telnet port will be left exposed to unrestricted remote access. Remote users with malicious intent will be able to access the device to cause a denial of service, or potentially monitor printer activity to gather information that may be used to compromise systems.
Additionally, this problem is compounded by the fact that the admin password is reset when the device is rebooted.
HP JetDirect JetAdmin is the installation and management software for HP's line of commercial print servers.
HP JetDirect devices configured using the JetAdmin web interface do not set a password for telnet access when the administrator password is chosen. As a result, the telnet port will be left exposed to unrestricted remote access. Remote users with malicious intent will be able to access the device to cause a denial of service, or potentially monitor printer activity to gather information that may be used to compromise systems.
Additionally, this problem is compounded by the fact that the admin password is reset when the device is rebooted.
Exploit / POC
HP JetDirect JetAdmin Password Vulnerability
No exploit is required.
No exploit is required.
Solution / Fix
HP JetDirect JetAdmin Password Vulnerability
Solution:
Currently the SecurityFocus staff are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently the SecurityFocus staff are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
HP JetDirect JetAdmin Password Vulnerability
References:
References:
- HP JetAdmin Product Support Page (Hewlett Packard)