Sign-up

ID

VAR-200604-0081


CVE

CVE-2006-1654


TITLE

HP Color LaserJet 2500/4600 Toolbox Directory Traversal Vulnerability

Trust: 0.9

sources: BID: 17367 // CNNVD: CNNVD-200604-081

DESCRIPTION

Directory traversal vulnerability in the HP Color LaserJet 2500 Toolbox and Color LaserJet 4600 Toolbox on Microsoft Windows before 20060402 allows remote attackers to read arbitrary files via a .. (dot dot) in an HTTP GET request to TCP port 5225. This issue is due to a failure in the application to properly sanitize user-supplied input. An attacker can exploit this vulnerability to retrieve arbitrary files from the vulnerable system in the context of the affected application. Information obtained may aid attackers in further attacks. The vulnerability is caused due to an input validation error in the built-in HTTP server. This can be exploited to disclose the contents of arbitrary files via directory traversal attacks. Example: http://[host]:5225/../../../[file] SOLUTION: Update to version 3.1. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

Trust: 1.26

sources: NVD: CVE-2006-1654 // BID: 17367 // PACKETSTORM: 45198

AFFECTED PRODUCTS

vendor:hpmodel:color laserjetscope:eqversion:4600dtn

Trust: 1.6

vendor:hpmodel:color laserjetscope:eqversion:4600dn

Trust: 1.6

vendor:hpmodel:color laserjetscope:eqversion:4600hdn

Trust: 1.6

vendor:hpmodel:color laserjet 2500nscope:eqversion:*

Trust: 1.0

vendor:hpmodel:color laserjet 2500scope:eqversion:*

Trust: 1.0

vendor:hpmodel:color laserjet 2500lsescope:eqversion:*

Trust: 1.0

vendor:hpmodel:color laserjet 2500 toolboxscope:eqversion:*

Trust: 1.0

vendor:hpmodel:color laserjet 4600 toolboxscope:eqversion:*

Trust: 1.0

vendor:hpmodel:color laserjet 2500tnscope:eqversion:*

Trust: 1.0

vendor:hpmodel:color laserjet 2500lscope:eqversion:*

Trust: 1.0

vendor:hpmodel:color laserjet 4600scope:eqversion:*

Trust: 1.0

vendor:hpmodel:color laserjet 4600scope: - version: -

Trust: 0.6

vendor:hpmodel:color laserjet 2500tnscope: - version: -

Trust: 0.6

vendor:hpmodel:color laserjet 2500lsescope: - version: -

Trust: 0.6

vendor:hpmodel:color laserjet 2500nscope: - version: -

Trust: 0.6

vendor:hpmodel:color laserjet 4600 toolboxscope: - version: -

Trust: 0.6

vendor:hpmodel:color laserjet 2500scope: - version: -

Trust: 0.6

vendor:hpmodel:color laserjet 2500lscope: - version: -

Trust: 0.6

vendor:hpmodel:color laserjet toolboxscope:eqversion:46000

Trust: 0.3

vendor:hpmodel:color laserjet toolboxscope:eqversion:25000

Trust: 0.3

sources: BID: 17367 // CNNVD: CNNVD-200604-081 // NVD: CVE-2006-1654

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2006-1654
value: MEDIUM

Trust: 1.0

CNNVD: CNNVD-200604-081
value: MEDIUM

Trust: 0.6

nvd@nist.gov: CVE-2006-1654
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.0

sources: CNNVD: CNNVD-200604-081 // NVD: CVE-2006-1654

PROBLEMTYPE DATA

problemtype:NVD-CWE-Other

Trust: 1.0

sources: NVD: CVE-2006-1654

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-200604-081

TYPE

path traversal

Trust: 0.6

sources: CNNVD: CNNVD-200604-081

EXTERNAL IDS

db:BIDid:17367

Trust: 1.9

db:SECUNIAid:19529

Trust: 1.7

db:SECTRACKid:1015862

Trust: 1.6

db:VUPENid:ADV-2006-1230

Trust: 1.6

db:NVDid:CVE-2006-1654

Trust: 1.6

db:OSVDBid:24396

Trust: 1.6

db:FULLDISCid:20060404 [SEC-1 LTD] HP COLOUR LASERJET 2500 AND 4600 TOOLBOX DIRECTORY TRAVERSAL VULNERABILITY

Trust: 0.6

db:XFid:25627

Trust: 0.6

db:BUGTRAQid:20060404 [SEC-1 LTD] HP COLOUR LASERJET 2500 AND 4600 TOOLBOX DIRECTORY TRAVERSAL VULNERABILITY

Trust: 0.6

db:HPid:HPSBPI2109

Trust: 0.6

db:CNNVDid:CNNVD-200604-081

Trust: 0.6

db:PACKETSTORMid:45198

Trust: 0.1

sources: BID: 17367 // PACKETSTORM: 45198 // CNNVD: CNNVD-200604-081 // NVD: CVE-2006-1654

REFERENCES

url:http://securitytracker.com/id?1015862

Trust: 1.6

url:http://archives.neohapsis.com/archives/fulldisclosure/2006-04/0085.html

Trust: 1.6

url:http://www.securityfocus.com/bid/17367

Trust: 1.6

url:http://www.osvdb.org/24396

Trust: 1.6

url:http://secunia.com/advisories/19529

Trust: 1.6

url:http://www.securityfocus.com/archive/1/429893/100/0/threaded

Trust: 1.0

url:http://www.securityfocus.com/archive/1/429984/100/0/threaded

Trust: 1.0

url:http://www.vupen.com/english/advisories/2006/1230

Trust: 1.0

url:https://exchange.xforce.ibmcloud.com/vulnerabilities/25627

Trust: 1.0

url:http://www.securityfocus.com/archive/1/archive/1/429893/100/0/threaded

Trust: 0.6

url:http://www.frsirt.com/english/advisories/2006/1230

Trust: 0.6

url:http://xforce.iss.net/xforce/xfdb/25627

Trust: 0.6

url:http://www.securityfocus.com/archive/1/archive/1/429984/100/0/threaded

Trust: 0.6

url:http://h20000.www2.hp.com/bizsupport/techsupport/softwaredescription.jsp?lang=en&cc=us&prodtypeid=18972&prodseriesid=81954&switem=lj-39377-1&prodnameid=81956&swenvoid=228&swlang=8&taskid=135&mode=3

Trust: 0.3

url:/archive/1/429984

Trust: 0.3

url:http://secunia.com/secunia_security_advisories/

Trust: 0.1

url:http://secunia.com/advisories/19529/

Trust: 0.1

url:http://itrc.hp.com/service/cki/docdisplay.do?docid=c00634759

Trust: 0.1

url:http://www.hp.com/go/clj2500_software

Trust: 0.1

url:http://[host]:5225/../../../[file]

Trust: 0.1

url:http://secunia.com/product/9172/

Trust: 0.1

url:http://www.hp.com/go/clj4600_software

Trust: 0.1

url:http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

Trust: 0.1

url:http://secunia.com/product/9173/

Trust: 0.1

url:http://secunia.com/about_secunia_advisories/

Trust: 0.1

sources: BID: 17367 // PACKETSTORM: 45198 // CNNVD: CNNVD-200604-081 // NVD: CVE-2006-1654

CREDITS

Richard Horsman

Trust: 0.6

sources: CNNVD: CNNVD-200604-081

SOURCES

db:BIDid:17367
db:PACKETSTORMid:45198
db:CNNVDid:CNNVD-200604-081
db:NVDid:CVE-2006-1654

LAST UPDATE DATE

2024-08-14T14:59:14.109000+00:00


SOURCES UPDATE DATE

db:BIDid:17367date:2006-04-10T18:12:00
db:CNNVDid:CNNVD-200604-081date:2006-04-07T00:00:00
db:NVDid:CVE-2006-1654date:2018-10-18T16:33:47.453

SOURCES RELEASE DATE

db:BIDid:17367date:2006-04-04T00:00:00
db:PACKETSTORMid:45198date:2006-04-06T18:10:32
db:CNNVDid:CNNVD-200604-081date:2006-04-06T00:00:00
db:NVDid:CVE-2006-1654date:2006-04-06T10:04:00