|
|
[ Message Precedent sur la mailing][ Message Suivant sur la mailing][ Precedent dans le fil][ Prochain dans le fil][ Index par Date][ Index par fil]
[Full-disclosure] DDIVRT-2008-19 HP JetDirect Web Administration Directory Traversal
Title
-----
DDIVRT-2008-19 HP
JetDirect Web Administration Directory Traversal
Severity
--------
High
Date Discovered
---------------
October 23, 2008
Discovered By
-------------
Digital Defense, Inc. Vulnerability Research Team
Credit: Shmoov and r@b13$
Vulnerability Description
-------------------------
The HP-ChaiSOE/1.0 embedded web server on certain HP
JetDirect printers allows a potential attacker to gain read only access to
directories and files outside of the web root. An attacker can leverage this
flaw to read arbitrary system configuration files, cached documents, etc.
Information obtained from an affected host may facilitate further attacks
against the host. Exploitation of this flaw is trivial using common web server
directory traversal techniques.
Solution Description
--------------------
The vendor has released an update. See http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01623905
for more details.
Digital Defense, Inc. recommends restricting access
to the HP JetDirect web administration interface to authorized hosts only.
Tested Systems / Software (with versions)
------------------------------------------
Embedded web server
HP-ChaiSOE/1.0 on:
HP JetDirect 2420
HP JetDirect 4250
Vendor Contact
--------------
HP
http://www.hp.com
|
Full-Disclosure - We believe in it.
Charter: link://[click]
Hosted and sponsored by Secunia - link://[click]
Archives de la liste de diffusion Secunia
Archives de la liste de diffusion Full Disclosure
| Mini-Tagwall des articles publiés sur SecuObs : | | | | sécurité, exploit, windows, microsoft, attaque, réseau, metasploit, outil, vulnérabilité, système, audit, virus, internet, usbsploit, données, linux, présentation, source, bluetooth, protocol, réseaux, reverse, vista, scanner, shell, meterpreter, engineering, conférence, rootkit, wishmaster, trames, téléphone, paquet, mobile, https, sysun, noyau, rapport, accès, libre, botnet, mémoire, téléphones, snort, intel |
| Mini-Tagwall de l'annuaire video : | | | | security, metasploit, biomet, biometric, windows, botnet, defcon, password, vmware, tutorial, exploit, conference, crypt, virus, lockpicking, attack, network, linux, rootkit, conficker, shmoocon, wireshark, server, meterpreter, ettercap, source, iphone, openvpn, openbsd, backtrack, iptables, openssh, deepsec, systm, hnncast, securitytube, brucon, shell, access, secconf, engineering, internet, virtual, fingerprint, firewall |
| Mini-Tagwall des articles de la revue de presse : | | | | security, microsoft, windows, hacker, attack, network, vulnerability, google, exploit, malware, internet, remote, iphone, server, inject, patch, apple, twitter, mobile, virus, ebook, facebook, vulnérabilité, crypt, source, linux, password, intel, research, virtual, phish, access, tutorial, trojan, social, privacy, firefox, adobe, overflow, office, cisco, conficker, botnet, pirate, sécurité |
| Mini-Tagwall des Tweets de la revue Twitter : | | | | security, linux, botnet, attack, metasploit, cisco, defcon, phish, exploit, google, inject, server, firewall, network, twitter, vmware, windows, microsoft, compliance, vulnerability, python, engineering, source, kernel, crypt, social, overflow, nessus, crack, hacker, virus, iphone, patch, virtual, javascript, malware, conficker, pentest, research, email, password, adobe, apache, proxy, backtrack |
|
|
|
|
|
