|
Dell Color Laser Printers Multiple Vulnerabilities
|
|
Secunia Advisory:
|
SA21630
|
|
|
Release Date:
|
2006-08-28
|
|
Popularity:
|
9,105 views
|
|
|
Critical:
|
Less critical
|
|
Impact:
|
Security Bypass
DoS
|
|
Where:
|
From local network
|
|
Solution Status:
|
Vendor Patch
|
|
| OS: | Dell Color Laser Printer 3000cn
Dell Color Laser Printer 3010cn
Dell Color Laser Printer 3100cn
Dell Color Laser Printer 3110cn
Dell Color Laser Printer 5100cn
Dell Color Laser Printer 5110cn
|
|
|
Subscribe:
|
Instant alerts on relevant vulnerabilities 
|
|
| CVE reference: | CVE-2006-2112
CVE-2006-2113
|
|
Description:
Some vulnerabilities have been reported in various Dell Color Laser Printers, which can be exploited by malicious people to bypass certain security restrictions or to cause a DoS (Denial of Service).
1) The embedded FTP server does not restrict the use of the FTP PORT command. This can be exploited to connect to arbitrary systems through the FTP server.
2) The embedded HTTP server does not authenticate certain HTTP requests correctly. This can be exploited to make unauthorized changes to the system configuration or to cause a DoS.
The vulnerability has been reported in Dell 5110cn, Dell 3110cn, and Dell 3010cn with firmware versions prior to A01 and in Dell 5100cn, Dell 3100cn, and Dell 3000cn with firmware versions prior to A05.
NOTE: Other products using the Fuji Xerox Printing Engine may also be affected.
Solution:
Apply patches.
Dell 5110cn (firmware versions prior to A01):
http://ftp.us.dell.com/printer/R130538.EXE
Dell 3110cn (firmware versions prior to A01):
http://ftp.us.dell.com/printer/R130356.EXE
Dell 3010cn (firmware versions prior to A01):
http://ftp.us.dell.com/printer/R132075.EXE
Dell 5100cn (firmware versions prior to A05):
http://ftp.us.dell.com/printer/R132718.EXE
Dell 3100cn (firmware versions prior to A05):
http://ftp.us.dell.com/printer/R132079.EXE
Dell 3000cn (firmware versions prior to A05):
http://ftp.us.dell.com/printer/R132368.EXE
Provided and/or discovered by:
Nate Johnson and Sean Krulewitch, Indiana University.
Original Advisory:
https://itso.iu.edu/20060824_FXPS_Print_Engine_Vulnerabilities
|
|
|
Track this Secunia Advisory
|
Customers of the Secunia Vulnerability Intelligence solutions will automatically receive updates when new information regarding this advisory is released.
Read more about our Vulnerability Intelligence solutions and what they can do for you and your company.
|
|
|
About this Secunia Advisory
|
Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise.
Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.
|
