============================================================================
\nFoofus.net Security Advisory: foofus-20111016
\n============================================================================
\nTitle:\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Toshiba eStudio Multifunction Printer Authentication Bypass
\nVersion:\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 e-Studio series devices
\nVendor:\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Toshiba
\nRelease Date:\u00a0\u00a0 01\/29\/2011
\nIssue Status:\u00a0\u00a0\u00a0 Contacted by Vendor on 2\/25\/2011 about release of a firmware patch.
\nUpdate Date:\u00a0\u00a0 10\/26\/2011
\n============================================================================<\/p>\n
1. Summary:<\/p>\n
Toshiba e-Studio devices found to be vulnerable to an authentication bypass
\nvulnerability.<\/p>\n
============================================================================<\/p>\n
2. Description:<\/p>\n
The authentication is easily bypassed by adding an extra \/ in the URL after
\nTopAccess.<\/p>\n
Example:
\nhttp:\/\/IP Address\/TopAccess\/\/Administrator\/Setup\/ScanToFile\/List.htm<\/p>\n
============================================================================<\/p>\n
3. Impact:<\/p>\n
Exploiting this allows an adversary to gain access to the device via the web
\nmanagement interface without authenticating.<\/p>\n
============================================================================<\/p>\n
4. Affected Products:<\/p>\n
All e-Studio devices tested against have been found to be vulnerable as of
\nJuly 2011.<\/p>\n
Validation of specific firmware versions have not been conducted on all devices.
\nThis is due to limited access to devices<\/p>\n
Confirmed devices and firmware:<\/p>\n
e-STUDIO3510c\u00a0\u00a0\u00a0\u00a0 firmware version T380SY0J040
\ne-STUDIO2830c \u00a0\u00a0\u00a0 firmware version T450SY0U233
\ne-STUDIO281c\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 firmware version T410SY0T233<\/p>\n
===========================================================================<\/p>\n
5. Solution:<\/p>\n
Contact vendor and request firmware upgrade to patch security issue<\/p>\n
============================================================================<\/p>\n
6) Time Table:<\/p>\n
01\/29\/2011 Reported Vulnerability.<\/p>\n
02\/25\/2011 Vendor acknowledged issue and stated firmware patch would soon
\nbe available<\/p>\n
March – July 2011 continued attempts to contact vendor to confirm firmware
\npatch. Request were never answered.
\n10\/16\/2011 Publishes Advisory<\/p>\n
============================================================================<\/p>\n
7) Credits: Discovered by Deral Heiland PercX<\/p>\n
============================================================================<\/p>\n
8. Reference:<\/p>\n
http:\/\/praeda.foofus.net<\/p>\n
http:\/\/www.foofus.net\/?page_id=411<\/p>\n
============================================================================<\/p>\n
The Foofus.Net team is an assortment of security professionals located
\nthrough out the United States. http:\/\/www.foofus.net<\/p>\n
============================================================================<\/p>\n","protected":false},"excerpt":{"rendered":"
============================================================================ Foofus.net Security Advisory: foofus-20111016 ============================================================================ Title:\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Toshiba eStudio Multifunction Printer Authentication Bypass Version:\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 e-Studio series devices Vendor:\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Toshiba Release Date:\u00a0\u00a0 01\/29\/2011 Issue Status:\u00a0\u00a0\u00a0 Contacted by Vendor on 2\/25\/2011 about release of a firmware patch. Update Date:\u00a0\u00a0 10\/26\/2011 ============================================================================ 1. Summary: Toshiba e-Studio devices found to be vulnerable to an authentication bypass vulnerability. ============================================================================ 2. […]<\/p>\n","protected":false},"author":1,"featured_media":0,"parent":273,"menu_order":1,"comment_status":"open","ping_status":"closed","template":"","meta":{"footnotes":""},"class_list":["post-411","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"http:\/\/h.foofus.net\/index.php?rest_route=\/wp\/v2\/pages\/411","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/h.foofus.net\/index.php?rest_route=\/wp\/v2\/pages"}],"about":[{"href":"http:\/\/h.foofus.net\/index.php?rest_route=\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"http:\/\/h.foofus.net\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/h.foofus.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=411"}],"version-history":[{"count":0,"href":"http:\/\/h.foofus.net\/index.php?rest_route=\/wp\/v2\/pages\/411\/revisions"}],"up":[{"embeddable":true,"href":"http:\/\/h.foofus.net\/index.php?rest_route=\/wp\/v2\/pages\/273"}],"wp:attachment":[{"href":"http:\/\/h.foofus.net\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=411"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}