Axis Print Server Web Interface Denial Of Service Vulnerability

Bugtraq ID:	8096
Class:	Failure to Handle Exceptional Conditions
CVE:
Remote:	Yes
Local:	No
Published:	Jul 03 2003 12:00AM
Updated:	Jul 03 2003 12:00AM
Credit:	Discovery of this vulnerability has been credited to Ian Vitek <[email protected]>.
Vulnerable:	Axis Communications Print Server 5600 6.20 Axis Communications Print Server 5600 6.15 Axis Communications Print Server 5600 6.10 Axis Communications Print Server 560 6.20 Axis Communications Print Server 560 6.15 Axis Communications Print Server 560 6.10
Not Vulnerable:

Axis Print Server Web Interface Denial Of Service Vulnerability

Axis Print Server web interface could expose the device to a denial of service vulnerability.

It has been reported that an attacker may make a malicious HTTP request that will trigger an exception in the affected server, effectively denying service to legitimate users.

It is not known if the denial of service is limited to the web interface or the entire appliance.

It should be noted that while this vulnerability has been reported to affect the web interface of Axis Print Server 560 and 5600 running firmware versions 6.10, 6.15 and 6.20, other versions might also be affected.

Axis Print Server Web Interface Denial Of Service Vulnerability

The following proof of concept has been supplied:

http://ps/u_server.shtm?port=a_server.shtm
http://ps/u_server.shtm?port=<!--
http://ps/?_

Axis Print Server Web Interface Denial Of Service Vulnerability

Solution:
The vendor has advised that affected customers upgrade to the latest available firmware, to resolve this issue.


Axis Communications Print Server 5600 6.10

• Axis Communications Axis Print Server Firmware
  ftp://ftp.axis.com/pub_soft/prt_srv/

Axis Communications Print Server 5600 6.15

• Axis Communications Axis Print Server Firmware
  ftp://ftp.axis.com/pub_soft/prt_srv/

Axis Communications Print Server 5600 6.20

• Axis Communications Axis Print Server Firmware
  ftp://ftp.axis.com/pub_soft/prt_srv/

Axis Print Server Web Interface Denial Of Service Vulnerability

References:

• Axis Print Server Homepage (Axis Communications)
  
• Minor security problem in Axis 560x web interface (Ian Vitek )