Sign-up

ID

VAR-201306-0344


CVE

CVE-2013-4615


TITLE

plural Canon Service disruption in printers (DoS) Vulnerabilities

Trust: 0.8

sources: JVNDB: JVNDB-2013-003113

DESCRIPTION

The Canon MG3100, MG5300, MG6100, MP495, MX340, MX870, MX890, MX920, and MX922 printers allow remote attackers to cause a denial of service (device hang) via a crafted LAN_TXT24 parameter to English/pages_MacUS/cgi_lan.cgi followed by a direct request to English/pages_MacUS/lan_set_content.html. NOTE: the vendor has apparently responded by stating "Canon believes that its printers will not have to deal with unauthorized access to the network from an external location as long as the printers are used in a secured environment.". Canon Printer is a printer developed by Canon. Many models of Canon Printer do not correctly handle user-submitted requests, allowing remote attackers to submit special HTTP requests, causing the printer to stop responding and need to be restarted for normal functionality. An attacker can exploit this issue to cause an affected device to stop responding and require a reboot, denying service to legitimate users. Vulnerabilities exist in the following models: MG3100, MG5300, MG6100, MP495, MX340, MX870, MX890, MX920, MX922. The below 3 issues have been tested and verified working on the following Canon Printer models (May affect more, but this is all I was able to test against): MG3100, MG5300, MG6100, MP495, MX340, MX870, MX890, MX920 #1 (CVE-2013-4613): Canon printers do not require a password for the administrative interfaces by default. Unauthorized users on the network may configure the printer. If the printer is exposed to the public internet, anonymous users may make configuration changes as well. This should be corrected by requiring a password, even if only a default, but should recommend users to change it upon initial setup of the device. #2 (CVE-2013-4614): The administrative interface on these printers allow a user to enter a WEP/WPA/WPA2 pre-shared key. Once a key is entered, when a user browses the configuration page again, they can view the current password in clear-text. Once a password is configured, it should not allow the user to read it again. If the user wants to change the password, they should be required to enter a new one, which then overwrites the old one. #3 (CVE-2013-4615): There is a denial of service condition in the administrative interface on the devices. Using specially crafted HTTP requests, it is possible to cause the device to no longer respond. This requires the device to be turned off, and then back on again, to which the printer will display a message about not being properly turned off, on the display (if model has a display). I have disclosed all 3 of these issues to Canon, and unfortunately they do not feel it is necessary to fix them (In all fairness, they're not super high severity). More details, along with PoC and Metasploit modules are available here: * http://www.mattandreko.com/2013/06/canon-y-u-no-security.html* Timeline: May 27, 2013: Initial Email to vendor's support May 28, 2013: Vendor support emailed for additional details May 28, 2013: Sent a proof-of-concept exploit for the DoS vulnerability to vendor May 30, 2013: Vendor escalated issue internally June 4, 2013: Vendor notification that issue has been escalated to manufacturer June 14, 2013: Vendor notification that they will not fix issues June 18, 2013: Public Disclosure

Trust: 2.61

sources: NVD: CVE-2013-4615 // JVNDB: JVNDB-2013-003113 // CNVD: CNVD-2013-07718 // BID: 60598 // VULHUB: VHN-64617 // PACKETSTORM: 122073

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2013-07718

AFFECTED PRODUCTS

vendor:canonmodel:mg3100 printerscope:eqversion: -

Trust: 1.6

vendor:canonmodel:mx870 printerscope:eqversion: -

Trust: 1.6

vendor:canonmodel:mp495 printerscope:eqversion: -

Trust: 1.6

vendor:canonmodel:mg6100 printerscope:eqversion: -

Trust: 1.6

vendor:canonmodel:mx922 printerscope:eqversion: -

Trust: 1.6

vendor:canonmodel:mp340 printerscope:eqversion: -

Trust: 1.6

vendor:canonmodel:mx890 printerscope:eqversion: -

Trust: 1.6

vendor:canonmodel:mx920 printerscope:eqversion: -

Trust: 1.6

vendor:canonmodel:mg5300 printerscope:eqversion: -

Trust: 1.6

vendor:canonmodel:pixma mp495scope: - version: -

Trust: 0.8

vendor:canonmodel:pixma mx340scope: - version: -

Trust: 0.8

vendor:canonmodel:pixma mx920scope: - version: -

Trust: 0.8

vendor:canonmodel:pixma mx922scope: - version: -

Trust: 0.8

vendor:canonmodel:pixus mg3130scope: - version: -

Trust: 0.8

vendor:canonmodel:pixus mg5330scope: - version: -

Trust: 0.8

vendor:canonmodel:pixus mg6130scope: - version: -

Trust: 0.8

vendor:canonmodel:pixus mx870scope: - version: -

Trust: 0.8

vendor:canonmodel:pixus mx893scope: - version: -

Trust: 0.8

vendor:canonmodel:printer mg3100scope: - version: -

Trust: 0.6

vendor:canonmodel:printer mg5300scope: - version: -

Trust: 0.6

vendor:canonmodel:printer mg6100scope: - version: -

Trust: 0.6

vendor:canonmodel:printer mp495scope: - version: -

Trust: 0.6

vendor:canonmodel:printer mx340scope: - version: -

Trust: 0.6

vendor:canonmodel:printer mx870scope: - version: -

Trust: 0.6

vendor:canonmodel:printer mx890scope: - version: -

Trust: 0.6

vendor:canonmodel:printer mx920scope: - version: -

Trust: 0.6

sources: CNVD: CNVD-2013-07718 // JVNDB: JVNDB-2013-003113 // CNNVD: CNNVD-201306-390 // NVD: CVE-2013-4615

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2013-4615
value: MEDIUM

Trust: 1.0

NVD: CVE-2013-4615
value: MEDIUM

Trust: 0.8

CNVD: CNVD-2013-07718
value: MEDIUM

Trust: 0.6

CNNVD: CNNVD-201306-390
value: MEDIUM

Trust: 0.6

VULHUB: VHN-64617
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2013-4615
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:N/I:N/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

CNVD: CNVD-2013-07718
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:N/I:N/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

VULHUB: VHN-64617
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:N/I:N/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: CNVD: CNVD-2013-07718 // VULHUB: VHN-64617 // JVNDB: JVNDB-2013-003113 // CNNVD: CNNVD-201306-390 // NVD: CVE-2013-4615

PROBLEMTYPE DATA

problemtype:CWE-20

Trust: 1.9

sources: VULHUB: VHN-64617 // JVNDB: JVNDB-2013-003113 // NVD: CVE-2013-4615

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201306-390

TYPE

input validation

Trust: 0.6

sources: CNNVD: CNNVD-201306-390

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2013-003113

PATCH
title:PIXUS 商品一覧url:http://cweb.canon.jp/pixus/lineup/
Trust: 0.8
sources:
            
            
            JVNDB: JVNDB-2013-003113

EXTERNAL IDS
db:NVDid:CVE-2013-4615
Trust: 3.5
db:BIDid:60598
Trust: 1.6
db:JVNDBid:JVNDB-2013-003113
Trust: 0.8
db:CNNVDid:CNNVD-201306-390
Trust: 0.7
db:CNVDid:CNVD-2013-07718
Trust: 0.6
db:FULLDISCid:20130618 CANON WIRELESS PRINTER DISCLOSURE & DOS
Trust: 0.6
db:VULHUBid:VHN-64617
Trust: 0.1
db:PACKETSTORMid:122073
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2013-07718 // 
            
            
            
            VULHUB: VHN-64617 // 
            
            
            
            BID: 60598 // 
            
            
            
            JVNDB: JVNDB-2013-003113 // 
            
            
            
            PACKETSTORM: 122073 // 
            
            
            
            CNNVD: CNNVD-201306-390 // 
            
            
            
            NVD: CVE-2013-4615

REFERENCES
url:http://www.mattandreko.com/2013/06/canon-y-u-no-security.html
Trust: 2.5
url:https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/dos/http/canon_wireless_printer.rb
Trust: 2.5
url:http://archives.neohapsis.com/archives/fulldisclosure/2013-06/0146.html
Trust: 1.7
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2013-4615
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2013-4615
Trust: 0.8
url:http://seclists.org/fulldisclosure/2013/jun/145
Trust: 0.6
url:http://www.securityfocus.com/bid/60598
Trust: 0.6
url:http://www.canon.com/
Trust: 0.3
url:https://nvd.nist.gov/vuln/detail/cve-2013-4614
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2013-4615
Trust: 0.1
url:http://www.mattandreko.com/2013/06/canon-y-u-no-security.html*
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2013-4613
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2013-07718 // 
            
            
            
            VULHUB: VHN-64617 // 
            
            
            
            BID: 60598 // 
            
            
            
            JVNDB: JVNDB-2013-003113 // 
            
            
            
            PACKETSTORM: 122073 // 
            
            
            
            CNNVD: CNNVD-201306-390 // 
            
            
            
            NVD: CVE-2013-4615

CREDITS
Matt Andreko
Trust: 1.0
sources:
            
            
            BID: 60598 // 
            
            
            
            PACKETSTORM: 122073 // 
            
            
            
            CNNVD: CNNVD-201306-390

SOURCES
db:CNVDid:CNVD-2013-07718
db:VULHUBid:VHN-64617
db:BIDid:60598
db:JVNDBid:JVNDB-2013-003113
db:PACKETSTORMid:122073
db:CNNVDid:CNNVD-201306-390
db:NVDid:CVE-2013-4615

LAST UPDATE DATE
2025-04-11T22:48:46.240000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2013-07718date:2013-06-21T00:00:00
db:VULHUBid:VHN-64617date:2013-06-24T00:00:00
db:BIDid:60598date:2013-06-18T00:00:00
db:JVNDBid:JVNDB-2013-003113date:2013-06-25T00:00:00
db:CNNVDid:CNNVD-201306-390date:2013-06-26T00:00:00
db:NVDid:CVE-2013-4615date:2025-04-11T00:51:21.963

SOURCES RELEASE DATE
db:CNVDid:CNVD-2013-07718date:2013-06-21T00:00:00
db:VULHUBid:VHN-64617date:2013-06-21T00:00:00
db:BIDid:60598date:2013-06-18T00:00:00
db:JVNDBid:JVNDB-2013-003113date:2013-06-25T00:00:00
db:PACKETSTORMid:122073date:2013-06-18T14:23:23
db:CNNVDid:CNNVD-201306-390date:2013-06-26T00:00:00
db:NVDid:CVE-2013-4615date:2013-06-21T21:55:01.057