Remote DOS HP JetDirect Print Servers

["handrix cobra" <handrix () gmail com>]

Vulnerability : Remote DOS HP JetDirect Print Servers
Product : HP JetDirect Print Servers "HP LaserJet Series"
By: Handrix <handrix_at_morx_org>
26 March 2007
MorX security research team
www.morx.org

+-------------+
| Description
:-------------------------------------------------------------------------------
+-------------+
|
| HP JetDirect print servers allow you to connect printers and other
| devices directly to a network.
|
| Such devices provide a variety of embeded services online, as like as ftp,
| snmp, web server, tftp ... and other daemon.
|
| However under a passive connection to the ftp's printers, and by sending a
RERT command
| with a big rang of data (271 to 277 char) as pathname, the ftp server turn
down,
| which cause the crash of the the engine.
+---------------------------------------------------------------------------------------------


+---------+
| Example
:-----------------------------------------------------------------------------------
+---------+
|
| % python /usr/lib/python2.4/ftplib.py -d [vulnerable host] -l -p `python
-c 'print "A"*300'`
+----------------------------------------------------------------------------------------------

+--------------------+
| Version vulnerable
:-----------------------------------------------------------------------
+--------------------+
|
| Hewlett-Packard FTP Print Server Version 2.4 and prior
+---------------------------------------------------------------------------------------------

+----------+
| Solution
:---------------------------------------------------------------------------------
+----------+
|
| Upgrade your drivers for your printers.
| By consulting the web page : http://www.hp.com/support/net_printing
+---------------------------------------------------------------------------------------------

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/