Details of VAR-200801-0124

ID

VAR-200801-0124

CVE

CVE-2008-0375

TITLE

OKI C5510MFP Printer CU Vulnerability to obtain administrator access rights

Trust: 0.8

sources: JVNDB: JVNDB-2008-003967

DESCRIPTION

Unspecified vulnerability in OKI C5510MFP Printer CU H2.15, PU 01.03.01, System F/W 1.01, and Web Page 1.00 allows remote attackers to set the password and obtain administrative access via unspecified vectors. An attacker can exploit this issue to set arbitrary printer configuration settings and administrative passwords. The impact of a successful exploit will vary depending on the settings reconfigured. ---------------------------------------------------------------------- A new version (0.9.0.0 - Release Candidate 1) of the free Secunia PSI has been released. The new version includes many new and advanced features, which makes it even easier to stay patched. Download and test it today: https://psi.secunia.com/ Read more about this new version: https://psi.secunia.com/?page=changelog ---------------------------------------------------------------------- TITLE: OKI C5510MFP Configuration Interface Security Issues SECUNIA ADVISORY ID: SA28553 VERIFY ADVISORY: http://secunia.com/advisories/28553/ CRITICAL: Less critical IMPACT: Security Bypass, Exposure of sensitive information WHERE: >From local network OPERATING SYSTEM: OKI C5550MFP http://secunia.com/product/17253/ DESCRIPTION: Compass Security AG has reported two security issues in OKI C5510MFP, which can be exploited by malicious people to disclose sensitive information and to bypass certain security restrictions. 1) A security issue is caused due to the configuration of the printer being sent in clear text when connecting to TCP ports 5548 or 7777. This can be exploited to obtain the administration password by connecting to the affected ports. 2) The problem is that the password can be reset without authentication. This can be exploited to gain access to the configuration interface. Other versions may also be affected. SOLUTION: Restrict network access to trusted users only. PROVIDED AND/OR DISCOVERED BY: Compass Security AG ORIGINAL ADVISORY: http://www.csnc.ch/en/modules/news/news_0004.html_1394092626.html ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

Trust: 2.07

sources: NVD: CVE-2008-0375 // JVNDB: JVNDB-2008-003967 // BID: 27339 // VULHUB: VHN-30500 // PACKETSTORM: 62775

AFFECTED PRODUCTS

vendor:	oki printing	model:	c5510 mfp printer	scope:	eq	version:	*	Trust: 1.0
vendor:	oki printing	model:	c5510 mfp printer	scope:	eq	version:	cu h2.15	Trust: 0.8
vendor:	oki printing	model:	c5510 mfp printer	scope:	eq	version:	pu 01.03.01	Trust: 0.8
vendor:	oki printing	model:	c5510 mfp printer	scope:	eq	version:	system f/w 1.01	Trust: 0.8
vendor:	oki printing	model:	c5510 mfp printer	scope:	eq	version:	and web page 1.00	Trust: 0.8
vendor:	oki printing	model:	c5510 mfp printer	scope:	-	version:	-	Trust: 0.6
vendor:	oki	model:	printing solutions c5510 mfp printer	scope:	eq	version:	0	Trust: 0.3

sources: BID: 27339 // JVNDB: JVNDB-2008-003967 // CNNVD: CNNVD-200801-326 // NVD: CVE-2008-0375

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2008-0375
value:	HIGH
Trust: 1.0
NVD:	CVE-2008-0375
value:	HIGH
Trust: 0.8
CNNVD:	CNNVD-200801-326
value:	CRITICAL
Trust: 0.6
VULHUB:	VHN-30500
value:	HIGH
Trust: 0.1

nvd@nist.gov:	CVE-2008-0375
severity:	HIGH
baseScore:	10.0
vectorString:	AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	10.0
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
VULHUB:	VHN-30500
severity:	HIGH
baseScore:	10.0
vectorString:	AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	10.0
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

sources: VULHUB: VHN-30500 // JVNDB: JVNDB-2008-003967 // CNNVD: CNNVD-200801-326 // NVD: CVE-2008-0375

PROBLEMTYPE DATA

problemtype:	CWE-264	Trust: 1.9
problemtype:	NVD-CWE-noinfo	Trust: 1.0

sources: VULHUB: VHN-30500 // JVNDB: JVNDB-2008-003967 // NVD: CVE-2008-0375

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-200801-326

TYPE

permissions and access control

Trust: 0.6

sources: CNNVD: CNNVD-200801-326

CONFIGURATIONS

sources: JVNDB: JVNDB-2008-003967

PATCH

title:

Top Page

url:

http://www.okiprintingsolutions.com/

Trust: 0.8

sources: JVNDB: JVNDB-2008-003967

EXTERNAL IDS

db:	NVD	id:	CVE-2008-0375	Trust: 2.8
db:	BID	id:	27339	Trust: 2.0
db:	SECUNIA	id:	28553	Trust: 1.8
db:	SREASON	id:	3569	Trust: 1.7
db:	JVNDB	id:	JVNDB-2008-003967	Trust: 0.8
db:	BUGTRAQ	id:	20080117 [CSNC] OKI C5510MFP PRINTER PASSWORD DISCLOSURE	Trust: 0.6
db:	XF	id:	39776	Trust: 0.6
db:	XF	id:	5510	Trust: 0.6
db:	CNNVD	id:	CNNVD-200801-326	Trust: 0.6
db:	VULHUB	id:	VHN-30500	Trust: 0.1
db:	PACKETSTORM	id:	62775	Trust: 0.1

sources: VULHUB: VHN-30500 // BID: 27339 // JVNDB: JVNDB-2008-003967 // PACKETSTORM: 62775 // CNNVD: CNNVD-200801-326 // NVD: CVE-2008-0375

REFERENCES

url:	http://www.csnc.ch/en/modules/news/news_0004.html_1394092626.html	Trust: 1.8
url:	http://www.securityfocus.com/bid/27339	Trust: 1.7
url:	http://secunia.com/advisories/28553	Trust: 1.7
url:	http://securityreason.com/securityalert/3569	Trust: 1.7
url:	http://www.securityfocus.com/archive/1/486511/100/0/threaded	Trust: 1.1
url:	https://exchange.xforce.ibmcloud.com/vulnerabilities/39776	Trust: 1.1
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2008-0375	Trust: 0.8
url:	http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2008-0375	Trust: 0.8
url:	http://www.securityfocus.com/archive/1/archive/1/486511/100/0/threaded	Trust: 0.6
url:	http://xforce.iss.net/xforce/xfdb/39776	Trust: 0.6
url:	http://www.okiprintingsolutions.com	Trust: 0.3
url:	/archive/1/486511	Trust: 0.3
url:	http://secunia.com/secunia_security_advisories/	Trust: 0.1
url:	http://secunia.com/product/17253/	Trust: 0.1
url:	https://psi.secunia.com/?page=changelog	Trust: 0.1
url:	https://psi.secunia.com/	Trust: 0.1
url:	http://secunia.com/advisories/28553/	Trust: 0.1
url:	http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org	Trust: 0.1
url:	http://secunia.com/about_secunia_advisories/	Trust: 0.1

sources: VULHUB: VHN-30500 // BID: 27339 // JVNDB: JVNDB-2008-003967 // PACKETSTORM: 62775 // CNNVD: CNNVD-200801-326 // NVD: CVE-2008-0375

CREDITS

Adrian Leuenberger

Trust: 0.6

sources: CNNVD: CNNVD-200801-326

SOURCES

db:	VULHUB	id:	VHN-30500
db:	BID	id:	27339
db:	JVNDB	id:	JVNDB-2008-003967
db:	PACKETSTORM	id:	62775
db:	CNNVD	id:	CNNVD-200801-326
db:	NVD	id:	CVE-2008-0375

LAST UPDATE DATE

2025-04-10T23:07:17.991000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-30500	date:	2018-10-15T00:00:00
db:	BID	id:	27339	date:	2016-07-06T14:17:00
db:	JVNDB	id:	JVNDB-2008-003967	date:	2012-09-25T00:00:00
db:	CNNVD	id:	CNNVD-200801-326	date:	2008-09-05T00:00:00
db:	NVD	id:	CVE-2008-0375	date:	2025-04-09T00:30:58.490

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-30500	date:	2008-01-22T00:00:00
db:	BID	id:	27339	date:	2008-01-17T00:00:00
db:	JVNDB	id:	JVNDB-2008-003967	date:	2012-09-25T00:00:00
db:	PACKETSTORM	id:	62775	date:	2008-01-19T00:33:48
db:	CNNVD	id:	CNNVD-200801-326	date:	2008-01-22T00:00:00
db:	NVD	id:	CVE-2008-0375	date:	2008-01-22T20:00:00