Sign-up

ID

VAR-201112-0173


CVE

CVE-2011-4161


TITLE

Hewlett-Packard printers and scanner devices allow remote unautheticated firmware updates

Trust: 0.8

sources: CERT/CC: VU#717921

DESCRIPTION

The default configuration of the HP CM8060 Color MFP with Edgeline; Color LaserJet 3xxx, 4xxx, 5550, 9500, CMxxxx, CPxxxx, and Enterprise CPxxxx; Digital Sender 9200c and 9250c; LaserJet 4xxx, 5200, 90xx, Mxxxx, and Pxxxx; and LaserJet Enterprise 500 color M551, 600, M4555 MFP, and P3015 enables the Remote Firmware Update (RFU) setting, which allows remote attackers to execute arbitrary code by using a session on TCP port 9100 to upload a crafted firmware update. A vulnerability in certain Hewlett-Packard devices could allow a remote attacker to install unauthorized firmware on an affected system. HP Printers and HP Digital Senders are prone to a remote code-execution vulnerability. Successfully exploiting this issue allows an attacker to execute arbitrary code with administrative privileges. A successful exploit will result in the complete compromise of affected devices. This BID is being retired. The issue is already documented in BID 50876 (HP Printers and Digital Senders Remote Firmware Update Security Bypass Vulnerability). The unauthorized firmware could also cause a Denial of Service to the device. References: CVE-2011-4161 SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed. Please refer to the RESOLUTION below for a list of impacted products. A firmware update can be sent remotely to port 9100 without authentication. RESOLUTION The following steps can be taken to avoid unauthorized firmware updates: Update the firmware to a version that implements code signing Disable the Remote Firmware Update The code signing feature verifies that firmware updates are properly signed. This will prevent the installation of invalid firmware updates. Note: A firmware update may be required to allow the RFU to be disabled or to implement code signing. Code signing is not available on all the affected devices. Please refer to the following table. Firmware updates for any of the products can also be downloaded as follows. Browse to www.hp.com/go/support then: Select "Drivers & Software" Enter the product name listed in the table above into the search field Click on "Search" If the search returns a list of products click on the appropriate product Under "Select operating system" click on "Cross operating system (BIOS, Firmware, Diagnostics, etc.)" If the "Cross operating system ..." link is not present, select any Windows operating system from the list. Select the appropriate firmware update under "Firmware" HISTORY Version:1 (rev.1) - 30 November 2011 Initial release Version:2 (rev.2) - 23 December 2011 Code signing firmware available Version:3 (rev.3) - 9 January 2012 Combined tables Third Party Security Patches: Third party security patches that are to be installed on systems running HP software products should be applied in accordance with the customer's patch management policy. Support: For issues about implementing the recommendations of this Security Bulletin, contact normal HP Services support channel. For other issues about the content of this Security Bulletin, send e-mail to security-alert@hp.com. Report: To report a potential security vulnerability with any HP supported product, send Email to: security-alert@hp.com Subscribe: To initiate a subscription to receive future HP Security Bulletin alerts via Email: http://h41183.www4.hp.com/signup_alerts.php?jumpid=hpsc_secbulletins Security Bulletin List: A list of HP Security Bulletins, updated periodically, is contained in HP Security Notice HPSN-2011-001: https://h20566.www2.hp.com/portal/site/hpsc/public/kb/docDisplay/?docId=emr_na-c02964430 Security Bulletin Archive: A list of recently released Security Bulletins is available here: http://h20566.www2.hp.com/portal/site/hpsc/public/kb/secBullArchive/ Software Product Category: The Software Product Category is represented in the title by the two characters following HPSB. 3C = 3COM 3P = 3rd Party Software GN = HP General Software HF = HP Hardware and Firmware MP = MPE/iX MU = Multi-Platform Software NS = NonStop Servers OV = OpenVMS PI = Printing and Imaging PV = ProCurve ST = Storage Software TU = Tru64 UNIX UX = HP-UX Copyright 2012 Hewlett-Packard Development Company, L.P. Hewlett-Packard Company shall not be liable for technical or editorial errors or omissions contained herein. The information provided is provided "as is" without warranty of any kind. To the extent permitted by law, neither HP or its affiliates, subcontractors or suppliers will be liable for incidental,special or consequential damages including downtime cost; lost profits;damages relating to the procurement of substitute products or services; or damages for loss of data, or software restoration. The information in this document is subject to change without notice. Hewlett-Packard Company and the names of Hewlett-Packard products referenced herein are trademarks of Hewlett-Packard Company in the United States and other countries. Other product and company names mentioned herein may be trademarks of their respective owners. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) iEYEARECAAYFAk8KykcACgkQ4B86/C0qfVl09ACg1m3AQDGq/VzvFgb4j6bj3fJU VnkAoO9oPSjyrVB07qLIBpcXALxLRRRg =mXzy -----END PGP SIGNATURE----- . However, the information is applicable to all the devices listed above. This can be exploited to upload a malicious firmware to device via a specially crafted request to TCP port 9100. PROVIDED AND/OR DISCOVERED BY: Salvatore Stolfo and Ang Cui, Columbia University. ORIGINAL ADVISORY: HPSBPI02728 SSRT100692: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03102449 OTHER REFERENCES: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ DEEP LINKS: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXTENDED DESCRIPTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXTENDED SOLUTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXPLOIT: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ---------------------------------------------------------------------- . This revision, version 6, of the Security Bulletin announces the availability of firmware updates for additional devices

Trust: 3.51

sources: NVD: CVE-2011-4161 // CERT/CC: VU#717921 // JVNDB: JVNDB-2011-003178 // BID: 51324 // BID: 50876 // PACKETSTORM: 108233 // PACKETSTORM: 108485 // PACKETSTORM: 110973 // PACKETSTORM: 109909 // PACKETSTORM: 107448 // PACKETSTORM: 107446 // PACKETSTORM: 112220

AFFECTED PRODUCTS

vendor:hpmodel:color mfp cm8060scope:eqversion: -

Trust: 1.6

vendor:hpmodel:color laserjet cm4730scope:eqversion:mfp

Trust: 1.6

vendor:hpmodel:color laserjet cp3525scope: - version: -

Trust: 1.2

vendor:hpmodel:laserjet 5200scope:eqversion:*

Trust: 1.0

vendor:hpmodel:laserjet m5035scope:eqversion:*

Trust: 1.0

vendor:hpmodel:laserjet 4345 mfpscope:eqversion:*

Trust: 1.0

vendor:hpmodel:color laserjet enterprise cp4520scope:eqversion:*

Trust: 1.0

vendor:hpmodel:color laserjet 3000scope:eqversion:*

Trust: 1.0

vendor:hpmodel:color laserjet cp5525scope:eqversion:*

Trust: 1.0

vendor:hpmodel:color laserjet cp3505scope:eqversion:*

Trust: 1.0

vendor:hpmodel:color laserjet enterprise cp4525scope:eqversion:*

Trust: 1.0

vendor:hpmodel:color laserjet 4730scope:eqversion:mfp

Trust: 1.0

vendor:hpmodel:color laserjet cm3530scope:eqversion:*

Trust: 1.0

vendor:hpmodel:color laserjet cp4005scope:eqversion:*

Trust: 1.0

vendor:hpmodel:color laserjet 9500scope:eqversion:*

Trust: 1.0

vendor:hpmodel:laserjet enterprise 600scope:eqversion:m601

Trust: 1.0

vendor:hpmodel:color laserjet 3800scope:eqversion:*

Trust: 1.0

vendor:hpmodel:laserjet m9050scope:eqversion:*

Trust: 1.0

vendor:hpmodel:color laserjet cm6030scope:eqversion:*

Trust: 1.0

vendor:hpmodel:laserjet p3005scope:eqversion:*

Trust: 1.0

vendor:hpmodel:laserjet enterprise 600scope:eqversion:m602

Trust: 1.0

vendor:hpmodel:laserjet m9040scope:eqversion:*

Trust: 1.0

vendor:hpmodel:laserjet p4014scope:eqversion:*

Trust: 1.0

vendor:hpmodel:laserjet 4350scope:eqversion:*

Trust: 1.0

vendor:hpmodel:laserjet 9040scope:eqversion:*

Trust: 1.0

vendor:hpmodel:laserjet enterprise p3015scope:eqversion:*

Trust: 1.0

vendor:hpmodel:laserjet p4015scope:eqversion:*

Trust: 1.0

vendor:hpmodel:color laserjet cp6015scope:eqversion:*

Trust: 1.0

vendor:hpmodel:color laserjet cp3525scope:eqversion:*

Trust: 1.0

vendor:hpmodel:color laserjet cm4540scope:eqversion:mfp

Trust: 1.0

vendor:hpmodel:laserjet 9050scope:eqversion:*

Trust: 1.0

vendor:hpmodel:color laserjet cm6040scope:eqversion:*

Trust: 1.0

vendor:hpmodel:laserjet m3035scope:eqversion:*

Trust: 1.0

vendor:hpmodel:digital sender 9250cscope:eqversion:*

Trust: 1.0

vendor:hpmodel:color laserjet 5550scope:eqversion:*

Trust: 1.0

vendor:hpmodel:laserjet 4250scope:eqversion:*

Trust: 1.0

vendor:hpmodel:color laserjet 4700scope:eqversion:*

Trust: 1.0

vendor:hpmodel:color laserjet 4730 mfpscope:eqversion:*

Trust: 1.0

vendor:hpmodel:laserjet enterprise 600scope:eqversion:m603

Trust: 1.0

vendor:hpmodel:laserjet enterprise m4555scope:eqversion:mfp

Trust: 1.0

vendor:hpmodel:laserjet p4515scope:eqversion:*

Trust: 1.0

vendor:hpmodel:digital sender 9200cscope:eqversion:*

Trust: 1.0

vendor:hpmodel:laserjet enterprise 500 colorscope:eqversion:m551

Trust: 1.0

vendor:hpmodel:laserjet 4240scope:eqversion:*

Trust: 1.0

vendor:hpmodel:color laserjet enterprise cp4525scope: - version: -

Trust: 0.9

vendor:hpmodel:color laserjet enterprise cp4520scope: - version: -

Trust: 0.9

vendor:hpmodel:color laserjet cp6015scope: - version: -

Trust: 0.9

vendor:hpmodel:color laserjet cp5525scope: - version: -

Trust: 0.9

vendor:hpmodel:color laserjet cm6040scope: - version: -

Trust: 0.9

vendor:hewlett packardmodel: - scope: - version: -

Trust: 0.8

vendor:hewlett packardmodel:hp cm8060 color mfp with edgelinescope: - version: -

Trust: 0.8

vendor:hewlett packardmodel:hp color laserjet 3000scope: - version: -

Trust: 0.8

vendor:hewlett packardmodel:hp color laserjet 3800scope: - version: -

Trust: 0.8

vendor:hewlett packardmodel:hp color laserjet 4700scope: - version: -

Trust: 0.8

vendor:hewlett packardmodel:hp color laserjet 4730 mfpscope: - version: -

Trust: 0.8

vendor:hewlett packardmodel:hp color laserjet 5550scope: - version: -

Trust: 0.8

vendor:hewlett packardmodel:hp color laserjet 9500scope: - version: -

Trust: 0.8

vendor:hewlett packardmodel:hp color laserjet cm3530scope: - version: -

Trust: 0.8

vendor:hewlett packardmodel:hp color laserjet cm4540 mfpscope: - version: -

Trust: 0.8

vendor:hewlett packardmodel:hp color laserjet cm4730 mfpscope: - version: -

Trust: 0.8

vendor:hewlett packardmodel:hp color laserjet cm6030scope: - version: -

Trust: 0.8

vendor:hewlett packardmodel:hp color laserjet cm6040scope: - version: -

Trust: 0.8

vendor:hewlett packardmodel:hp color laserjet cp3505scope: - version: -

Trust: 0.8

vendor:hewlett packardmodel:hp color laserjet cp3525scope: - version: -

Trust: 0.8

vendor:hewlett packardmodel:hp color laserjet cp4005scope: - version: -

Trust: 0.8

vendor:hewlett packardmodel:hp color laserjet cp5525scope: - version: -

Trust: 0.8

vendor:hewlett packardmodel:hp color laserjet cp6015scope: - version: -

Trust: 0.8

vendor:hewlett packardmodel:hp color laserjet enterprise cp4520scope: - version: -

Trust: 0.8

vendor:hewlett packardmodel:hp color laserjet enterprise cp4525scope: - version: -

Trust: 0.8

vendor:hewlett packardmodel:hp digital sender 9200cscope: - version: -

Trust: 0.8

vendor:hewlett packardmodel:hp digital sender 9250cscope: - version: -

Trust: 0.8

vendor:hewlett packardmodel:hp laserjet 4240scope: - version: -

Trust: 0.8

vendor:hewlett packardmodel:hp laserjet 4250scope: - version: -

Trust: 0.8

vendor:hewlett packardmodel:hp laserjet 4345 mfpscope: - version: -

Trust: 0.8

vendor:hewlett packardmodel:hp laserjet 4350scope: - version: -

Trust: 0.8

vendor:hewlett packardmodel:hp laserjet 5200scope: - version: -

Trust: 0.8

vendor:hewlett packardmodel:hp laserjet 9040scope: - version: -

Trust: 0.8

vendor:hewlett packardmodel:hp laserjet 9050scope: - version: -

Trust: 0.8

vendor:hewlett packardmodel:hp laserjet enterprise 500 color m551scope: - version: -

Trust: 0.8

vendor:hewlett packardmodel:hp laserjet enterprise 600scope:eqversion:m601

Trust: 0.8

vendor:hewlett packardmodel:hp laserjet enterprise 600scope:eqversion:m602

Trust: 0.8

vendor:hewlett packardmodel:hp laserjet enterprise 600scope:eqversion:m603

Trust: 0.8

vendor:hewlett packardmodel:hp laserjet enterprise m4555 mfpscope: - version: -

Trust: 0.8

vendor:hewlett packardmodel:hp laserjet enterprise p3015scope: - version: -

Trust: 0.8

vendor:hewlett packardmodel:hp laserjet m3035scope: - version: -

Trust: 0.8

vendor:hewlett packardmodel:hp laserjet m5035scope: - version: -

Trust: 0.8

vendor:hewlett packardmodel:hp laserjet m9040scope: - version: -

Trust: 0.8

vendor:hewlett packardmodel:hp laserjet m9050scope: - version: -

Trust: 0.8

vendor:hewlett packardmodel:hp laserjet p3005scope: - version: -

Trust: 0.8

vendor:hewlett packardmodel:hp laserjet p4014scope: - version: -

Trust: 0.8

vendor:hewlett packardmodel:hp laserjet p4015scope: - version: -

Trust: 0.8

vendor:hewlett packardmodel:hp laserjet p4515scope: - version: -

Trust: 0.8

vendor:hpmodel:laserjet professional cp5225 printerscope:eqversion:0

Trust: 0.6

vendor:hpmodel:laserjet pro m1536 multifunction printerscope:eqversion:0

Trust: 0.6

vendor:hpmodel:laserjet pro cp1525 color printerscope:eqversion:0

Trust: 0.6

vendor:hpmodel:laserjet pro cm1415 color multifunction printerscope:eqversion:0

Trust: 0.6

vendor:hpmodel:laserjet p4515scope:eqversion:0

Trust: 0.6

vendor:hpmodel:laserjet p4015scope:eqversion:0

Trust: 0.6

vendor:hpmodel:laserjet p4014scope:eqversion:0

Trust: 0.6

vendor:hpmodel:laserjet p3005scope:eqversion:0

Trust: 0.6

vendor:hpmodel:laserjet p2055scope:eqversion:0

Trust: 0.6

vendor:hpmodel:laserjet p2035scope:eqversion:0

Trust: 0.6

vendor:hpmodel:laserjet m9040scope:eqversion:0

Trust: 0.6

vendor:hpmodel:laserjet m3027scope:eqversion:0

Trust: 0.6

vendor:hpmodel:laserjet m2727 multifunction printerscope:eqversion:0

Trust: 0.6

vendor:hpmodel:laserjet m1522 multifunction printerscope:eqversion:0

Trust: 0.6

vendor:hpmodel:laserjet enterprise p3015scope:eqversion:0

Trust: 0.6

vendor:hpmodel:laserjet enterprise m4555scope:eqversion:0

Trust: 0.6

vendor:hpmodel:laserjet enterprise m603scope:eqversion:600

Trust: 0.6

vendor:hpmodel:laserjet enterprise m602scope:eqversion:600

Trust: 0.6

vendor:hpmodel:laserjet enterprise m601scope:eqversion:600

Trust: 0.6

vendor:hpmodel:laserjetscope:eqversion:90500

Trust: 0.6

vendor:hpmodel:laserjetscope:eqversion:90400

Trust: 0.6

vendor:hpmodel:laserjet 5200nscope:eqversion:0

Trust: 0.6

vendor:hpmodel:laserjet 5200lscope:eqversion:0

Trust: 0.6

vendor:hpmodel:laserjetscope:eqversion:43500

Trust: 0.6

vendor:hpmodel:laserjetscope:eqversion:42500

Trust: 0.6

vendor:hpmodel:laserjetscope:eqversion:42400

Trust: 0.6

vendor:hpmodel:digital sender 9200cscope:eqversion:0

Trust: 0.6

vendor:hpmodel:color laserjet enterprise cm4540scope:eqversion:0

Trust: 0.6

vendor:hpmodel:color laserjet cp6015scope:eqversion:0

Trust: 0.6

vendor:hpmodel:color laserjet cp5525scope:eqversion:0

Trust: 0.6

vendor:hpmodel:color laserjet cp4005nscope:eqversion:0

Trust: 0.6

vendor:hpmodel:color laserjet cp3505scope:eqversion:0

Trust: 0.6

vendor:hpmodel:color laserjet cp2025scope:eqversion:0

Trust: 0.6

vendor:hpmodel:color laserjet cp1510scope:eqversion:0

Trust: 0.6

vendor:hpmodel:color laserjet cm6040scope:eqversion:0

Trust: 0.6

vendor:hpmodel:color laserjet cm6030scope:eqversion:0

Trust: 0.6

vendor:hpmodel:color laserjet cm4730 mfpscope:eqversion:0

Trust: 0.6

vendor:hpmodel:color laserjet cm3530scope:eqversion:0

Trust: 0.6

vendor:hpmodel:color laserjet cm2320 multifunction printerscope:eqversion:0

Trust: 0.6

vendor:hpmodel:color laserjet cm1312 multifunction printerscope:eqversion:0

Trust: 0.6

vendor:hpmodel:color laserjetscope:eqversion:5550

Trust: 0.6

vendor:hpmodel:color laserjet mfpscope:eqversion:47300

Trust: 0.6

vendor:hpmodel:color laserjet 3800nscope:eqversion:0

Trust: 0.6

vendor:hpmodel:color laserjetscope:eqversion:3000

Trust: 0.6

vendor:hpmodel:cm8060 color mfp with edgelinescope:eqversion:0

Trust: 0.6

vendor:hpmodel:color laserjet cp4005scope: - version: -

Trust: 0.6

vendor:hpmodel:color laserjet cp3505scope: - version: -

Trust: 0.6

vendor:hpmodel:laserjet m9050 mfpscope:eqversion:0

Trust: 0.3

vendor:hpmodel:laserjet m5035scope:eqversion:0

Trust: 0.3

vendor:hpmodel:laserjet m5025scope:eqversion:0

Trust: 0.3

vendor:hpmodel:laserjet m4345scope:eqversion:0

Trust: 0.3

vendor:hpmodel:laserjet m3035scope: - version: -

Trust: 0.3

vendor:hpmodel:ds9200c digital senderscope:eqversion:0

Trust: 0.3

vendor:hpmodel:color laserjet cp4525scope:eqversion:0

Trust: 0.3

vendor:hpmodel:color laserjet 4730mfpscope:eqversion:0

Trust: 0.3

vendor:hpmodel:color laserjet 4700nscope:eqversion:0

Trust: 0.3

vendor:hpmodel:topshot laserjet pro m275scope:eqversion:0

Trust: 0.3

vendor:hpmodel:laserjet pro p1606dnscope:eqversion:0

Trust: 0.3

vendor:hpmodel:laserjet pro p1102scope:eqversion:0

Trust: 0.3

vendor:hpmodel:laserjet pro m1212nf multifunction printer seriesscope:eqversion:0

Trust: 0.3

vendor:hpmodel:laserjet pro m1136 multifunction printer seriesscope:eqversion:0

Trust: 0.3

vendor:hpmodel:laserjet pro cp1025 color printer seriesscope:eqversion:0

Trust: 0.3

vendor:hpmodel:laserjet pro mfp color m475scope:eqversion:4000

Trust: 0.3

vendor:hpmodel:laserjet pro color m451scope:eqversion:4000

Trust: 0.3

vendor:hpmodel:laserjet pro color mfp m375scope:eqversion:3000

Trust: 0.3

vendor:hpmodel:laserjet pro color m351scope:eqversion:3000

Trust: 0.3

vendor:hpmodel:laserjet pro color mfp m175scope:eqversion:1000

Trust: 0.3

vendor:hpmodel:laserjet p1500 printer seriesscope:eqversion:0

Trust: 0.3

vendor:hpmodel:laserjet m5035 multifunction printerscope:eqversion:0

Trust: 0.3

vendor:hpmodel:laserjet m5025 multifunction printerscope:eqversion:0

Trust: 0.3

vendor:hpmodel:laserjet m4345x mfpscope:eqversion:0

Trust: 0.3

vendor:hpmodel:laserjet m3035scope:eqversion:0

Trust: 0.3

vendor:hpmodel:laserjet m1319 multifunction printer seriesscope:eqversion:0

Trust: 0.3

vendor:hpmodel:laserjet m1120 multifunction printer seriesscope:eqversion:0

Trust: 0.3

vendor:hpmodel:laserjet enterprise p3015scope: - version: -

Trust: 0.3

vendor:hpmodel:laserjet enterprise m4555 mfpscope: - version: -

Trust: 0.3

vendor:hpmodel:laserjet enterprise color m551scope:eqversion:500

Trust: 0.3

vendor:hpmodel:laserjet mfpscope:eqversion:90500

Trust: 0.3

vendor:hpmodel:laserjet 9040mpfscope:eqversion:0

Trust: 0.3

vendor:hpmodel:laserjetscope:eqversion:4350

Trust: 0.3

vendor:hpmodel:laserjet mfpscope:eqversion:43450

Trust: 0.3

vendor:hpmodel:laserjet m9050scope: - version: -

Trust: 0.3

vendor:hpmodel:laserjet m5035scope: - version: -

Trust: 0.3

vendor:hpmodel:laserjetscope:eqversion:5200

Trust: 0.3

vendor:hpmodel:ds9250c digital senderscope:eqversion:0

Trust: 0.3

vendor:hpmodel:digital sender 9250cscope: - version: -

Trust: 0.3

vendor:hpmodel:color laserjet cp3525 printerscope:eqversion:53.031.4

Trust: 0.3

vendor:hpmodel:color laserjet cp3525 printerscope:eqversion:05.059.3

Trust: 0.3

vendor:hpmodel:color laserjet cp3525 printerscope:eqversion:05.058.4

Trust: 0.3

vendor:hpmodel:color laserjet cp1210 printer seriesscope:eqversion:0

Trust: 0.3

vendor:hpmodel:color laserjet 9500mfpscope:eqversion:0

Trust: 0.3

vendor:hpmodel:color laserjetscope:eqversion:47000

Trust: 0.3

vendor:hpmodel:color laserjet 3000nscope:eqversion:0

Trust: 0.3

vendor:hpmodel:color laserjetscope:eqversion:28000

Trust: 0.3

vendor:hpmodel:color laserjet cm1312nfiscope: - version: -

Trust: 0.3

vendor:hpmodel:color laserjetscope:eqversion:9500

Trust: 0.3

sources: CERT/CC: VU#717921 // BID: 51324 // BID: 50876 // JVNDB: JVNDB-2011-003178 // CNNVD: CNNVD-201111-528 // NVD: CVE-2011-4161

CVSS

SEVERITY

CVSSV2

CVSSV3

NVD: CVE-2011-4161
value: HIGH

Trust: 1.6

nvd@nist.gov: CVE-2011-4161
value: HIGH

Trust: 1.0

CNNVD: CNNVD-201111-528
value: CRITICAL

Trust: 0.6

nvd@nist.gov: CVE-2011-4161
severity: HIGH
baseScore: 10.0
vectorString: AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

NVD: CVE-2011-4161
severity: HIGH
baseScore: 10.0
vectorString: NONE
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.8

sources: CERT/CC: VU#717921 // JVNDB: JVNDB-2011-003178 // CNNVD: CNNVD-201111-528 // NVD: CVE-2011-4161

PROBLEMTYPE DATA

problemtype:CWE-264

Trust: 1.8

sources: JVNDB: JVNDB-2011-003178 // NVD: CVE-2011-4161

THREAT TYPE

network

Trust: 0.6

sources: BID: 51324 // BID: 50876

TYPE

permissions and access control

Trust: 0.6

sources: CNNVD: CNNVD-201111-528

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2011-003178

EXPLOIT AVAILABILITY
sources:
            
            
            CERT/CC: VU#717921

PATCH
title:HP Imaging and Printing Security Best Practicesurl:http://h71028.www7.hp.com/enterprise/downloads/HP-Imaging10.pdf
Trust: 0.8
title:HPSBPI02728 SSRT100692url:http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c03102449
Trust: 0.8
sources:
            
            
            JVNDB: JVNDB-2011-003178

EXTERNAL IDS
db:NVDid:CVE-2011-4161
Trust: 3.3
db:CERT/CCid:VU#717921
Trust: 1.8
db:SECUNIAid:47063
Trust: 1.7
db:BIDid:51324
Trust: 1.3
db:SECTRACKid:1026357
Trust: 1.0
db:JVNDBid:JVNDB-2011-003178
Trust: 0.8
db:NSFOCUSid:19500
Trust: 0.6
db:NSFOCUSid:18263
Trust: 0.6
db:MLISTid:[DAILYDAVE] 20111130 THE VAMPIRE DIARIES
Trust: 0.6
db:HPid:HPSBPI02728
Trust: 0.6
db:HPid:SSRT100692
Trust: 0.6
db:CNNVDid:CNNVD-201111-528
Trust: 0.6
db:BIDid:50876
Trust: 0.3
db:PACKETSTORMid:108233
Trust: 0.1
db:PACKETSTORMid:108485
Trust: 0.1
db:PACKETSTORMid:110973
Trust: 0.1
db:PACKETSTORMid:109909
Trust: 0.1
db:PACKETSTORMid:107448
Trust: 0.1
db:PACKETSTORMid:107446
Trust: 0.1
db:PACKETSTORMid:112220
Trust: 0.1
sources:
            
            
            CERT/CC: VU#717921 // 
            
            
            
            BID: 51324 // 
            
            
            
            BID: 50876 // 
            
            
            
            JVNDB: JVNDB-2011-003178 // 
            
            
            
            PACKETSTORM: 108233 // 
            
            
            
            PACKETSTORM: 108485 // 
            
            
            
            PACKETSTORM: 110973 // 
            
            
            
            PACKETSTORM: 109909 // 
            
            
            
            PACKETSTORM: 107448 // 
            
            
            
            PACKETSTORM: 107446 // 
            
            
            
            PACKETSTORM: 112220 // 
            
            
            
            CNNVD: CNNVD-201111-528 // 
            
            
            
            NVD: CVE-2011-4161

REFERENCES
url:http://h20000.www2.hp.com/bizsupport/techsupport/document.jsp?objectid=c03102449
Trust: 2.6
url:http://redtape.msnbc.msn.com/_news/2011/11/29/9076395-exclusive-millions-of-printers-open-to-devastating-hack-attack-researchers-say
Trust: 1.9
url:http://jvn.jp/cert/jvnvu717921/index.html
Trust: 1.6
url:https://lists.immunityinc.com/pipermail/dailydave/2011-november/000378.html
Trust: 1.6
url:http://isc.sans.org/diary/hacking+hp+printers+for+fun+and+profit/12112
Trust: 1.6
url:http://secunia.com/advisories/47063
Trust: 1.6
url:http://www.kb.cert.org/vuls/id/717921
Trust: 1.0
url:http://www.securityfocus.com/bid/51324
Trust: 1.0
url:http://www.securitytracker.com/id?1026357
Trust: 1.0
url:http://h71028.www7.hp.com/enterprise/downloads/hp-imaging10.pdf
Trust: 0.9
url:http://h20000.www2.hp.com/bizsupport/techsupport/document.jsp?objectid=c03102449&jumpid=em_alerts_us-us_dec11_xbu_all_all_1514802_101529_printersandmultifunctionscanners-copiers-faxes_critical_000_0
Trust: 0.8
url:http://h20565.www2.hp.com/portal/site/hpsc/template.page/public/kb/docdisplay/?docid=emr_na-c03102449-6
Trust: 0.8
url:http://ids.cs.columbia.edu/sites/default/files/ndss-2013.pdf
Trust: 0.8
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2011-4161
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2011-4161
Trust: 0.8
url:https://nvd.nist.gov/vuln/detail/cve-2011-4161
Trust: 0.6
url:http://www.hp.com/go/secureprinting
Trust: 0.6
url:http://h20566.www2.hp.com/portal/site/hpsc/public/kb/secbullarchive/
Trust: 0.6
url:http://h41183.www4.hp.com/signup_alerts.php?jumpid=hpsc_secbulletins
Trust: 0.6
url:https://h20566.www2.hp.com/portal/site/hpsc/public/kb/docdisplay/?docid=emr_na-c02964430
Trust: 0.6
url:http://www.nsfocus.net/vulndb/19500
Trust: 0.6
url:http://www.nsfocus.net/vulndb/18263
Trust: 0.6
url:https://www.hp.com/go/support
Trust: 0.5
url:http://www.hp.com
Trust: 0.3
url:/archive/1/521159
Trust: 0.3
url:http://h20000.www2.hp.com/bizsupport/techsupport/document.jsp?objectid=c03154309
Trust: 0.3
url:http://www.hp.com/
Trust: 0.3
url:https://h20565.www2.hp.com/portal/site/hpsc/public/kb/docdisplay/?docid=emr_na-c03102449&ac.admitted=1329506517580.876444892.492883150
Trust: 0.3
url:https://h20566.www2.hp.com/portal/site/hpsc/public/kb/docdisplay/?docid=emr_na-c03102449&ac.admitted=1332174200510.876444892.199480143
Trust: 0.3
url:/archive/1/521693
Trust: 0.3
url:http://h20000.www2.hp.com/bizsupport/techsupport/document.jsp?objectid=c03154309&jumpid=em_alerts_us-us_jan12_xbu_all_all_1590794_104946_printersandmultifunctionscanners-copiers-faxes_routine_002_1
Trust: 0.3
url:https://ca.secunia.com/?page=viewadvisory&vuln_id=47063
Trust: 0.1
url:http://secunia.com/company/jobs/
Trust: 0.1
url:http://secunia.com/advisories/47063/#comments
Trust: 0.1
url:http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
Trust: 0.1
url:http://secunia.com/vulnerability_intelligence/
Trust: 0.1
url:http://secunia.com/advisories/secunia_security_advisories/
Trust: 0.1
url:http://secunia.com/vulnerability_scanning/personal/
Trust: 0.1
url:http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
Trust: 0.1
url:http://secunia.com/advisories/47063/
Trust: 0.1
url:http://secunia.com/advisories/about_secunia_advisories/
Trust: 0.1
sources:
            
            
            CERT/CC: VU#717921 // 
            
            
            
            BID: 51324 // 
            
            
            
            BID: 50876 // 
            
            
            
            JVNDB: JVNDB-2011-003178 // 
            
            
            
            PACKETSTORM: 108233 // 
            
            
            
            PACKETSTORM: 108485 // 
            
            
            
            PACKETSTORM: 110973 // 
            
            
            
            PACKETSTORM: 109909 // 
            
            
            
            PACKETSTORM: 107448 // 
            
            
            
            PACKETSTORM: 107446 // 
            
            
            
            PACKETSTORM: 112220 // 
            
            
            
            CNNVD: CNNVD-201111-528 // 
            
            
            
            NVD: CVE-2011-4161

CREDITS
HP
Trust: 0.9
sources:
            
            
            BID: 51324 // 
            
            
            
            PACKETSTORM: 108233 // 
            
            
            
            PACKETSTORM: 108485 // 
            
            
            
            PACKETSTORM: 110973 // 
            
            
            
            PACKETSTORM: 109909 // 
            
            
            
            PACKETSTORM: 107448 // 
            
            
            
            PACKETSTORM: 112220

SOURCES
db:CERT/CCid:VU#717921
db:BIDid:51324
db:BIDid:50876
db:JVNDBid:JVNDB-2011-003178
db:PACKETSTORMid:108233
db:PACKETSTORMid:108485
db:PACKETSTORMid:110973
db:PACKETSTORMid:109909
db:PACKETSTORMid:107448
db:PACKETSTORMid:107446
db:PACKETSTORMid:112220
db:CNNVDid:CNNVD-201111-528
db:NVDid:CVE-2011-4161

LAST UPDATE DATE
2024-09-15T23:15:49.260000+00:00

SOURCES UPDATE DATE
db:CERT/CCid:VU#717921date:2013-12-02T00:00:00
db:BIDid:51324date:2014-01-27T00:34:00
db:BIDid:50876date:2014-01-25T08:48:00
db:JVNDBid:JVNDB-2011-003178date:2011-12-12T00:00:00
db:CNNVDid:CNNVD-201111-528date:2011-12-02T00:00:00
db:NVDid:CVE-2011-4161date:2012-09-18T03:28:13.693

SOURCES RELEASE DATE
db:CERT/CCid:VU#717921date:2011-12-08T00:00:00
db:BIDid:51324date:2012-01-09T00:00:00
db:BIDid:50876date:2011-11-30T00:00:00
db:JVNDBid:JVNDB-2011-003178date:2011-12-05T00:00:00
db:PACKETSTORMid:108233date:2011-12-29T23:29:31
db:PACKETSTORMid:108485date:2012-01-09T20:58:54
db:PACKETSTORMid:110973date:2012-03-19T22:42:32
db:PACKETSTORMid:109909date:2012-02-18T03:14:17
db:PACKETSTORMid:107448date:2011-12-01T21:32:32
db:PACKETSTORMid:107446date:2011-12-01T01:32:02
db:PACKETSTORMid:112220date:2012-04-26T22:31:50
db:CNNVDid:CNNVD-201111-528date:2011-12-02T00:00:00
db:NVDid:CVE-2011-4161date:2011-12-01T21:55:00.707