Re: buffer overflow in HP JetDirect module (probably affects all

From: Brian (cazzat_private)
Date: Fri Nov 19 1999 - 17:21:20 PST

  • Next message: Darren Reed: "Re: local users can panic linux kernel (was: SuSE syslogd"

    --qMm9M+Fa2AknHoGS
    Content-Type: text/plain; charset=us-ascii
    Content-Transfer-Encoding: quoted-printable
    
    > Obviously it's a M680x0 CPU with 512 KB of RAM in our model, so
    > writing an exploit should be fairly easy. The nice point about it is
    > that most people wouldn't expect their printer to be compromised --
    > and since there is no logging on the printer, you can't easily be
    > tracked down...
    
    HP JetDirects can have the web server turned off (a good idea) and use
    remote syslog to log all connections to the printer.  The HP print
    server control software automaticly turns the web configuration back
    on, so I wouldn't use that, I would physicly go up to the printer and
    disable all services you don't need. =20
    
    If only one could add in ip allow ranges, then I would be happy.
    
    -cazz
    
    --qMm9M+Fa2AknHoGS
    Content-Type: application/pgp-signature
    
    -----BEGIN PGP SIGNATURE-----
    Version: GnuPG v1.0.0 (GNU/Linux)
    Comment: For info see http://www.gnupg.org
    
    iD8DBQE4NfePac/1Eph0QDwRARmNAJ9TX2TCUnoNokmCUlnTFRP+cIulMQCfTygh
    dv0s52LKconrt3ZukkjXbGU=
    =PU6l
    -----END PGP SIGNATURE-----
    
    --qMm9M+Fa2AknHoGS--
    



    This archive was generated by hypermail 2b30 : Fri Apr 13 2001 - 15:13:46 PDT