Re: Jetdirect card Attack???

From: Brendan Murphy (bmurphyat_private)
Date: Thu Jul 19 2001 - 16:42:29 PDT

  • Next message: Dean Cunningham: "RE: HTTP connections"

    I heard of one of these on campus this morning as well here at the
    University of Colorado at Denver....two actually.  We're filtering the 515
    attacks, and one of my colleagues seems to think its a side effect of the
    code red problem.  Seems logical...a lot of the JetDirect cards have port
    80 open on them....
    
    Brendan
    
    On Thu, 19 Jul 2001, James Edwards wrote:
    
    > Yesterday, one of the printers here in ITS began printing a Jetdirect
    > Diagnostic Page showing a S/W Exception 00fb and a core dump
    > ("Registers", "Stack", and "Register Pointer Memory Dump" in Hex). I
    > changed the slot, and the error followed (from EIO1 to EIO2),
    > therefore I guessed that the card was bad. Today another printer
    > began to share the same symptoms. I have a hard time believing that
    > two cards would go bad at the same time
    >
    > Has anyone else noted this phenomenon??
    >
    > Could it be a different type of printer attack than the port 515 attacks??
    >
    > Jim
    >
    > (PS, I've already called John and notified him--he asked me to post
    > here (I'm also posting to the Security Focus list) for feedback.)
    > --
    > James Edwards
    > Instructional Technology Consultant
    > Instructional Technology Services
    > Adams Humanities-1109, MC-8114
    > San Diego State University
    > San Diego, Ca. 92182-8114
    >
    >   (619) 594-5727
    >   mailto:jedwardsat_private
    >   Fax (619) 594-4061
    >   <http://www-rohan.sdsu.edu/dept/its/directory/staff.html#Jim>
    >
    >
    > ----------------------------------------------------------------------------
    >
    >
    > This list is provided by the SecurityFocus ARIS analyzer service.
    > For more information on this free incident handling, management
    > and tracking system please see:
    >
    > http://aris.securityfocus.com
    >
    >
    
    Brendan Murphy
    Network, Video, and DSL Services
    University of Colorado-Denver
    Computing, Information & Network Services (CINS)
    ~~~
    TEL 303-556-4308
    FAX 303-556-2318
    ~~~
    "Obstacles are the only things people see
     when they take their eyes off their goals."
    
    
    
    ----------------------------------------------------------------------------
    
    
    This list is provided by the SecurityFocus ARIS analyzer service.
    For more information on this free incident handling, management 
    and tracking system please see:
    
    http://aris.securityfocus.com
    



    This archive was generated by hypermail 2b30 : Thu Jul 19 2001 - 20:06:48 PDT