Secunia

Kevin Finisterre has reported a vulnerability in Lexmark X1100 Series, which can be exploited by malicious, local users to gain escalated privileges.

The vulnerability is caused due to the printing program invoking the browser with SYSTEM privileges rather than using the privileges of the currently logged on user, when the user clicks on the "Additional styles (skins) are available on the Lexmark web site" button. This can be exploited to execute arbitrary commands with escalated privileges by invoking cmd.exe from the browser.

The vulnerability has been reported in the driver included with Lexmark X1185. Other versions may also be affected.

Solution
Grant only trusted users access to affected systems.

Provided and/or discovered by
Kevin Finisterre

Changelog
Further details available in Customer Area

Deep Links
Links available in Customer Area