Overview
\n——————-
\nCertain Lexmark devices are vulnerable to unverified password changes and stored cross-site scripting attacks.<\/p>\n
Description:
\n——————-
\nUnverified Password Change – CVE-2013-6032
\nCertain models of Lexmark laser printers and MarkNet devices are vulnerable to an attack which allows a remote unauthenticated attacker to change the administrative password of the printer’s web administration interface. The interface does not perform sufficient validation of the vac.255.GENPASSWORD parameter in POST requests to the \/cgi-bin\/postpf\/cgi-bin\/dynamic\/config\/config.html page, allowing an unauthenticated remote attacker to reset the administrative password to an empty string.<\/p>\n
Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) – CVE-2013-6033
\nCertain models of Lexmark laser printers are vulnerable to stored cross-site scripting attacks. The printers’ administrative web interface does not perform sufficient validation of user input to the “Location” and “Contact Name” fields in the “General Settings” configuration page.<\/p>\n
Impact:
\n——————-
\nAn attacker may be able to run arbitrary script in the context of a victim’s browser. The attacker may also be able to gain full administrative control of the printer.<\/p>\n
Solution:
\n——————-
\nApply an Update<\/p>\n
Lexmark advises users to update to the latest firmware version. A list of affected models and firmware versions, as well as accompanying fixes, can be found at Lexmark’s advisory page.
\nVendor Information: http:\/\/support.lexmark.com\/alerts\/<\/p>\n
CVSS Metrics:
\n——————-
\nGroup Score Vector
\nBase 9.0 AV:N\/AC:L\/Au:N\/C:P\/I:P\/A:C
\nTemporal 7.4 E:F\/RL:OF\/RC:C
\nEnvironmental 1.9 CDP:N\/TD:L\/CR:ND\/IR:ND\/AR:ND<\/p>\n
Vendor Date Notified: 16 Oct 2013<\/p>\n","protected":false},"excerpt":{"rendered":"
Overview ——————- Certain Lexmark devices are vulnerable to unverified password changes and stored cross-site scripting attacks. Description: ——————- Unverified Password Change – CVE-2013-6032 Certain models of Lexmark laser printers and MarkNet devices are vulnerable to an attack which allows a remote unauthenticated attacker to change the administrative password of the printer’s web administration interface. The […]<\/p>\n","protected":false},"author":13,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2,1],"tags":[],"class_list":["post-752","post","type-post","status-publish","format-standard","hentry","category-advisories","category-uncategorized"],"_links":{"self":[{"href":"http:\/\/h.foofus.net\/index.php?rest_route=\/wp\/v2\/posts\/752","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/h.foofus.net\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/h.foofus.net\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/h.foofus.net\/index.php?rest_route=\/wp\/v2\/users\/13"}],"replies":[{"embeddable":true,"href":"http:\/\/h.foofus.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=752"}],"version-history":[{"count":3,"href":"http:\/\/h.foofus.net\/index.php?rest_route=\/wp\/v2\/posts\/752\/revisions"}],"predecessor-version":[{"id":756,"href":"http:\/\/h.foofus.net\/index.php?rest_route=\/wp\/v2\/posts\/752\/revisions\/756"}],"wp:attachment":[{"href":"http:\/\/h.foofus.net\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=752"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/h.foofus.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=752"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/h.foofus.net\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=752"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}