http://www.informationweek.com/security/vulnerabilities/security-flaws-leave-networked-printers/240146805 By Mathew J. Schwartz Informationweek January 23, 2013 Printers that use popular print server software sold by Hewlett-Packard are vulnerable to attacks that can bypass built-in biometric defenses, recover previously printed documents and crash all vulnerable machines attached to a network. That warning comes from viaForensics researcher Sebastian Guerrero, who said he identified the security problems in HP's JetDirect software while testing printers in his spare time. JetDirect software is used in internal, external and embedded print servers sold by numerous printer manufacturers -- everyone from Canon and Lexmark to Samsung and Xerox. The software handles any printing request made via a network, in part by adding additional information, which then gets parsed by a printer. This additional information is in the form of tags such as UEL (universal exit language), which notes the beginning and end of data streams; PJL (printer job language), to tell the printer what to do; and PCL (printer control language), which formats pages. But these HP printer language command tags can also be used by attackers to evade security controls built into the devices -- such as fingerprint or smart card checks -- as well as to knock the machines offline, reprint previously printed documents or even brick the device. [...] ______________________________________________ Visit the InfoSec News Security Bookstore Best Selling Security Books and More! http://www.shopinfosecnews.orgReceived on Thu Jan 24 2013 - 00:14:03 PST
This archive was generated by hypermail 2.2.0 : Thu Jan 24 2013 - 00:10:08 PST