20080229 Canon MFD FTP bounce attack
Indiana University Security Advisory:
Canon Multi Function Devices vulnerable to FTP bounce attack.
Advisory ID:
20080229 Canon MFD FTP bounce attack
Advisory revisions:
- 02-29-2008 0500 UTC 1.0 Initial Public Release
Credit/acknowledgement:
CVE-2008-0303
- Date of discovery: 09-27-2007
- Nate Johnson, Lead Security Engineer, Indiana University
Summary:
Certain Canon Multi Function Devices (see Products affected below) allow remote attackers to redirect traffic to other sites (aka FTP bounce) via the PORT command, a variant of CVE-1999-0017.
Mitigation/workarounds:
- Disable FTP printing:
- Navigate to Additional Functions -> System Settings -> Network Settings -> TCP/IP Settings -> FTP print.
- Set FTP print to OFF.
- Protect FTP printing with username/password credentials:
- Navigate to Additional Functions -> System Settings -> Network Settings -> TCP/IP Settings -> FTP print.
- Set "user name" and "password" for the FTP print functionality.
Firmware updates that fix the vulnerability are available, but are not user installable. They require a service technician call. If one of the above two workarounds are not sufficient, please contact your local Canon Authorized Service Dealer.
Additionally, best practices suggest that access controls and network firewall policies be put into place to only allow connections from trusted machines and networks.
Criticality:
This vulnerability has a risk of not critical.
Products affected:
- imageRUNNER 2230/2830/3530
- imageRUNNER 3025/3030/3035/3045
- imageRUNNER 2270/2870/3570/4570
- imageRUNNER 5070/5570/6570
- imageRUNNER 5050/5055/5065/5075
- imageRUNNER 8070/85+/9070/105+
- imageRUNNER 7086/7095/7105
- Color imageRUNNER C3220/2620
- Color imageRUNNER C2880/3380
- Color imageRUNNER C2550
- Color imageRUNNER C4080/4580/5180/5185
- Color imageRUNNER LBP5960
- Color imageRUNNER LBP5360
- imageRUNNER C3170
- imageRUNNER C5800/6800
- imageRUNNER C5870U/6870U
- imageRUNNER C5058/5068
- imageRUNNER LBP3460
- imagePRESS C7000VP
- imagePRESS C1
References:
