HP JetDirect Printers SNMP Get Administrative Password Retrieval Vulnerability

Bugtraq ID:	5331
Class:	Design Error
CVE:	CVE-2002-1048
Remote:	Yes
Local:	No
Published:	Jul 27 2002 12:00AM
Updated:	Jul 11 2009 02:56PM
Credit:	Vulnerability discovery credited to FX <[email protected]> and kim0 <[email protected]>.
Vulnerable:	HP JetDirect J3111A rev. G.08.03 HP JetDirect J3111A rev. G.07.17 HP JetDirect J3111A rev. G.07.03 HP JetDirect J3111A rev. G.07.02 HP JetDirect J3111A rev. G.05.35 HP JetDirect J3111A rev. A.08.06 HP JetDirect x.21.00 HP JetDirect x.20.00 HP JetDirect x.08.32 HP JetDirect x.08.20 HP JetDirect x.08.05 HP JetDirect x.08.04 HP JetDirect x.08.00
Not Vulnerable:

HP JetDirect Printers SNMP Get Administrative Password Retrieval Vulnerability

JetDirect printers are network-enabled printers distributed by Hewlett-Packard.

It has been reported that HP JetDirect printers leak the telnet and HTTP administrative password under some circumstances. By sending an SNMP READ request to a vulnerable printer, the printer will return the hex-encoded password to the requester. This could allow a remote user to access and change configuration of the printer.

HP JetDirect Printers SNMP Get Administrative Password Retrieval Vulnerability

No exploit is required for this vulnerability.

HP JetDirect Printers SNMP Get Administrative Password Retrieval Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

HP JetDirect Printers SNMP Get Administrative Password Retrieval Vulnerability

References:

• Phenoelit Advisory (Phenoelit Group)