Re: JetDirect password disclosure

From: Renaud Deraison (deraisonat_private)
Date: Tue Mar 04 2003 - 09:30:12 PST

  • Next message: Geoff Humes: "RE: JetDirect password disclosure" 

    On Tue, Mar 04, 2003 at 06:25:44PM +0100, Javier Fernandez-Sanguino wrote:
> Renaud Deraison wrote:
> >Could anyone test this plugin on a password protected JetDirect, and
> >confirm that it indeed works ? (I could only test it on a non-password
> >protected HP jetdirect which has a crashed telnet server :)
> >
> 
> 
> Doesn't work for me. I'm testing against an HP JetDirect printer that 
> _does_ answer when doing
>  snmpget -v 1 -c internal XXXXX .1.3.6.1.4.1.11.2.3.9.1.1.13.0

Could you run tcpdump -s 1500 -w snmp_for_renaud "udp and port 161"
while doing the command ? And while running the plugin ?

> After tracing the code the culprit seems to be this one:
> if(ord(r[17+strlen(community)]))exit(0);

This checks for the SNMP error message to be set. You want this one.

    This archive was generated by hypermail 2b30 : Tue Mar 04 2003 - 09:31:02 PST