============================================================================
\nFoofus.net Security Advisory: foofus-20111107
\n============================================================================
\nTitle:\u00a0\u00a0 \u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Lexmark Multifunction Printer Information exposure
\nVersion:\u00a0\u00a0 \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 X656de
\nVendor:\u00a0\u00a0 \u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0\u00a0 Lexmark
\nRelease Date: \u00a0 08\/05\/2011
\n============================================================================<\/p>\n
1. Summary:<\/p>\n
Lexmark multifunction printer device found to be vulnerable to an information leakage
\nvulnerability.<\/p>\n
============================================================================<\/p>\n
2. Description:<\/p>\n
Passwords can be extracted in plan text from the settings export file.
\nhttp:\/\/hostname-IP_Address\/cgi-bin\/exportfile\/printer\/config\/secure\/settingfile.ucf<\/p>\n
============================================================================<\/p>\n
3. Impact:<\/p>\n
Exploiting this allows an adversary to extract passwords that can be used to gain
\naccess to other critical systems.<\/p>\n
============================================================================<\/p>\n
4. Affected Products:
\nLexmark X656de multifunction printer (Firmware version LR.MN.P224a-0)
\nOther Lexmark and Dell branded Multifunction printers may also be vulnerable<\/p>\n
============================================================================<\/p>\n
5. Solution:<\/p>\n
Insure that a complex password is set on printer.<\/p>\n
Upgrade firmware to release version LR.MN.P311e or newer<\/p>\n
“To obtain firmware that resolves this issue, or if you have special
\ncode, please contact Lexmark\u2019s Technical Support Center to find your local
\nsupport center.”<\/p>\n
============================================================================<\/p>\n
6) Time Table:<\/p>\n
08\/05\/2011 Vulnerability disclosed.
\n11\/07\/2011 Publishes Advisory<\/p>\n
============================================================================<\/p>\n
7) Credits: Discovered by Deral Heiland PercX<\/p>\n
============================================================================<\/p>\n
8. Reference:
\nhttp:\/\/www.foofus.net\/?page_id=483
\nhttp:\/\/www.foofus.net
\nhttp:\/\/praeda.foofus.net<\/p>\n
============================================================================<\/p>\n
The Foofus.Net team is an assortment of security professionals located
\nthrough out the United States. http:\/\/www.foofus.net
\nFollow percX on Twitter @Percent_X<\/p>\n
============================================================================<\/p>\n","protected":false},"excerpt":{"rendered":"
============================================================================ Foofus.net Security Advisory: foofus-20111107 ============================================================================ Title:\u00a0\u00a0 \u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Lexmark Multifunction Printer Information exposure Version:\u00a0\u00a0 \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 X656de Vendor:\u00a0\u00a0 \u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0\u00a0 Lexmark Release Date: \u00a0 08\/05\/2011 ============================================================================ 1. Summary: Lexmark multifunction printer device found to be vulnerable to an information leakage vulnerability. ============================================================================ 2. Description: Passwords can be extracted in plan text from the settings export […]<\/p>\n","protected":false},"author":1,"featured_media":0,"parent":273,"menu_order":0,"comment_status":"open","ping_status":"closed","template":"","meta":{"footnotes":""},"class_list":["post-483","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"http:\/\/h.foofus.net\/index.php?rest_route=\/wp\/v2\/pages\/483","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/h.foofus.net\/index.php?rest_route=\/wp\/v2\/pages"}],"about":[{"href":"http:\/\/h.foofus.net\/index.php?rest_route=\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"http:\/\/h.foofus.net\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/h.foofus.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=483"}],"version-history":[{"count":0,"href":"http:\/\/h.foofus.net\/index.php?rest_route=\/wp\/v2\/pages\/483\/revisions"}],"up":[{"embeddable":true,"href":"http:\/\/h.foofus.net\/index.php?rest_route=\/wp\/v2\/pages\/273"}],"wp:attachment":[{"href":"http:\/\/h.foofus.net\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=483"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}