Published:2008/03/05  Last Updated:2008/05/21

JVN#10056705
FTP bounce vulnerability in multiple Canon digital multifunction copiers and laser beam printers

Overview

Multiple Canon digital multifunction copiers and laser beam printers contain a vulnerability that could allow a remote attacker to access other network devices via a built-in FTP server.

Products Affected

This vulnerability affects multiple products. For more information, refer to the Canon's website.

Description

The Canon Color imageRUNNER Series, imageRUNNER Series, imagePRESS Series, and laser beam printer series are digital multifunction copiers and printers. Some of these products contain a vulnerability that could allow a remote attacker to access other network devices via a built-in FTP server.

Impact

A remote attacker could use the FTP server of vulnerable products to conduct port scans against other network devices.

Solution

Change the Setting
Change the setting according to the information provided by the vendor. For more information, refer to the vendor's website.

Vendor Status

Vendor Status Last Update Vendor Notes
Canon Inc. Vulnerable 2008/08/25

References

JPCERT/CC Addendum

Vulnerability Analysis by JPCERT/CC

Analyzed on 2008.03.05

Measures Conditions Severity
Access Required Routed - can be attacked over the Internet using packets
  • High
Authentication Limited - self-registration, perhaps valid e-mail
  • Medium-High
User Interaction Required None - the vulnerability can be exploited without an honest user taking any action
  • High
Exploit Complexity Low-Medium - some expertise and/or luck required (most buffer overflows, guessing correctly in small space, expertise in Windows function calls)
  • Medium-High

Description of each analysis measures

Credit

Canon Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the vendors under Information Security Early Warning Partnership. Canon Inc. credits Nate Johnson and the Indiana University for reporting this vulnerability.

Other Information

JPCERT Alert
JPCERT Reports
CERT Advisory
CPNI Advisory
TRnotes
CVE CVE-2008-0303
JVN iPedia JVNDB-2008-000013

Update History