DDIVRT-2008-19 HP JetDirect Web Administration Directory Traversal

[vulnerabilityresearch () ddifrontline com]

Title
-----
DDIVRT-2008-19 HP JetDirect Web Administration Directory Traversal

Severity
--------
High

Date Discovered
---------------
October 23, 2008

Discovered By
-------------
Digital Defense, Inc. Vulnerability Research Team
Credit: Shmoov and r@b13$

Vulnerability Description
-------------------------
The HP-ChaiSOE/1.0 embedded web server on certain HP JetDirect printers allows a potential attacker to gain read only 
access to directories and files outside of the web root.  An attacker can leverage this flaw to read arbitrary system 
configuration files, cached documents, etc. Information obtained from an affected host may facilitate further attacks 
against the host.  Exploitation of this flaw is trivial using common web server directory traversal techniques.

Solution Description
--------------------
The vendor has released an update.  See 
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01623905 for more details.
Digital Defense, Inc. recommends restricting access to the HP JetDirect web administration interface to authorized 
hosts only.

Tested Systems / Software (with versions)
------------------------------------------
Embedded web server HP-ChaiSOE/1.0 on:
        HP JetDirect 2420
        HP JetDirect 4250


Vendor Contact
--------------
HP
http://www.hp.com