Sign-up

ID

VAR-201503-0320


CVE

CVE-2014-7888


TITLE

HP Point of Sale PCs Running Windows With OPOS Drivers Arbitrary Code Execution Vulnerability

Trust: 0.9

sources: BID: 72969 // CNNVD: CNNVD-201503-186

DESCRIPTION

The OLE Point of Sale (OPOS) drivers before 1.13.003 on HP Point of Sale Windows PCs allow remote attackers to execute arbitrary code via vectors involving OPOSMICR.ocx for PUSB Thermal Receipt printers, SerialUSB Thermal Receipt printers, Hybrid POS printers with MICR, Value PUSB Receipt printers, and Value Serial/USB Receipt printers, aka ZDI-CAN-2512. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the Open method in OPOSMICR.ocx. By supplying an overly long string to this method, an attacker can exploit this condition to achieve code execution under the context of the browser process. Attackers can exploit these issues to execute arbitrary code in the context of the affected application. Failed exploit attempts may result in a denial-of-service condition. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Note: the current version of the following document is available here: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emr_na-c04583185 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c04583185 Version: 2 HPSBHF03279 rev.2 - HP Point of Sale PCs Running Windows with OPOS Drivers, Remote Execution of Code NOTICE: The information in this Security Bulletin should be acted upon as soon as possible. These vulnerabilities could be remotely exploited resulting in execution of code. References: CVE-2014-7888 (ZDI-CAN-2512, SSRT101696) CVE-2014-7889 (ZDI-CAN-2511, SSRT101695) CVE-2014-7890 (ZDI-CAN-2510, SSRT101694) CVE-2014-7891 (ZDI-CAN-2509, SSRT101693) CVE-2014-7892 (ZDI-CAN-2508, SSRT101692) CVE-2014-7893 (ZDI-CAN-2507, SSRT101691) CVE-2014-7894 (ZDI-CAN-2506, SSRT101690) CVE-2014-7895 (ZDI-CAN-2505, SSRT101689) CVE-2014-7897 (SSRT101689) CVE-2014-7898 (SSRT101689) SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed. The package contains update common control objects for all of the impacted products in the table below. Download the SP70564 from the Support and Drivers site for the impacted product. Go to http://www.hp.com : Chose Support then Download Drivers Enter in your POS system name, such as product name HP rp5800 Retail System then click on Go. Choose the Appropriate OS after selecting the link for the appropriate product. The latest drivers will be in the Software - POS section. Download the OPOS Common Control Objects v1.13.003 Softpaq. HP Product Description Prod Num CVE Number, Impacted Driver Monitors HP Retail RP7 VFD Customer Display QZ701AA / AT CVE-2014-7889 OPOSLineDisplay.ocx HP Retail Integrated 2x20 Display G6U79AA / AT CVE-2014-7889 OPOSLineDisplay.ocx HP Retail Integrated 2x20 Complex G7G29AA / AT CVE-2014-7889 OPOSLineDisplay.ocx Printers HP PUSB Thermal Receipt Printer ALL FK224AA / AT CVE-2014-7895 OPOSCashDrawer.ocx CVE-2014-7894 OPOSPOSPrinter.ocx CVE-2014-7888 OPOSMICR.ocx CVE-2014-7893 OPOSCheckScanner.ocx HP SerialUSB Thermal Receipt Printer BM476AA / AT CVE-2014-7895 OPOSCashDrawer.ocx CVE-2014-7894 OPOSPOSPrinter.ocx CVE-2014-7888 OPOSMICR.ocx CVE-2014-7893 OPOSCheckScanner.ocx HP Hybrid POS Printer with MICR US FK184AA / AT CVE-2014-7895 OPOSCashDrawer.ocx CVE-2014-7894 OPOSPOSPrinter.ocx CVE-2014-7888 OPOSMICR.ocx CVE-2014-7893 OPOSCheckScanner.ocx HP Value PUSB Receipt Printer F7M67AA / AT CVE-2014-7895 OPOSCashDrawer.ocx CVE-2014-7894 OPOSPOSPrinter.ocx CVE-2014-7888 OPOSMICR.ocx CVE-2014-7893 OPOSCheckScanner.ocx HP Value Serial/USB Receipt Printer ALL F7M66AA / AT CVE-2014-7895 OPOSCashDrawer.ocx CVE-2014-7894 OPOSPOSPrinter.ocx CVE-2014-7888 OPOSMICR.ocx CVE-2014-7893 OPOSCheckScanner.ocx Cash Drawers HP USB Standard Duty Cash Drawer E8E45AA / AT CVE-2014-7895 OPOSCashDrawer.ocx MSR HP Mini MSR FK186AA / AT CVE-2014-7892 OPOSMSR.ocx HP Retail Integrated Dual-Head MSR QZ673AA / AT CVE-2014-7892 OPOSMSR.ocx HP Integrated Single Head MSR w/o SRED J1A33AA / AT CVE-2014-7892 OPOSMSR.ocx HP Integrated Single Head w/o MSR SRED J1A34AA / AT CVE-2014-7892 OPOSMSR.ocx HP RP7 Single Head MSR w/o SRED K1K15AA/AT CVE-2014-7892 OPOSMSR.ocx Keyboards HP POS Keyboard FK221AA / AT CVE-2014-7891 OPOSPOSKeyboard.ocx CVE-2014-7892 OPOSMSR.ocx CVE-2014-7890 OPOSToneIndicator.ocx HP POS Keyboard with MSR FK218AA / AT CVE-2014-7891 OPOSPOSKeyboard.ocx CVE-2014-7892 OPOSMSR.ocx CVE-2014-7890 OPOSToneIndicator.ocx Pole Displays POS Pole Display FK225AA / AT CVE-2014-7889 OPOSLineDisplay.ocx HP Graphical POS Pole Display QZ704AA / AT CVE-2014-7889 OPOSLineDisplay.ocx HP LCD Pole Display F7A93AA / AT CVE-2014-7889 OPOSLineDisplay.ocx Scanners HP Imaging Barcode Scanner BW868AA / AT CVE-2014-7897 OPOSScanner.ocx HP Linear Barcode Scanner QY405AA / AT CVE-2014-7897 OPOSScanner.ocx HP Presentation Barcode Scanner QY439AA / AT CVE-2014-7897 OPOSScanner.ocx HP Retail Integrated Barcode Scanner E1L07AA / AT CVE-2014-7897 OPOSScanner.ocx HP Wireless Barcode Scanner E6P34AA / AT CVE-2014-7897 OPOSScanner.ocx HP 2D Value Wireless Scanner K3L28AA CVE-2014-7897 OPOSScanner.ocx HISTORY Version:1 (rev.1) - 4 March 2015 Initial release Version:2 (rev.2) - 20 March 2015 Corrected and clarified download instructions Third Party Security Patches: Third party security patches that are to be installed on systems running HP software products should be applied in accordance with the customer's patch management policy. Support: For issues about implementing the recommendations of this Security Bulletin, contact normal HP Services support channel. For other issues about the content of this Security Bulletin, send e-mail to security-alert@hp.com. Report: To report a potential security vulnerability with any HP supported product, send Email to: security-alert@hp.com Subscribe: To initiate a subscription to receive future HP Security Bulletin alerts via Email: http://h41183.www4.hp.com/signup_alerts.php?jumpid=hpsc_secbulletins Security Bulletin Archive: A list of recently released Security Bulletins is available here: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/secBullArchive/ Software Product Category: The Software Product Category is represented in the title by the two characters following HPSB. 3C = 3COM 3P = 3rd Party Software GN = HP General Software HF = HP Hardware and Firmware MP = MPE/iX MU = Multi-Platform Software NS = NonStop Servers OV = OpenVMS PI = Printing and Imaging PV = ProCurve ST = Storage Software TU = Tru64 UNIX UX = HP-UX Copyright 2015 Hewlett-Packard Development Company, L.P. Hewlett-Packard Company shall not be liable for technical or editorial errors or omissions contained herein. The information provided is provided "as is" without warranty of any kind. To the extent permitted by law, neither HP or its affiliates, subcontractors or suppliers will be liable for incidental,special or consequential damages including downtime cost; lost profits; damages relating to the procurement of substitute products or services; or damages for loss of data, or software restoration. The information in this document is subject to change without notice. Hewlett-Packard Company and the names of Hewlett-Packard products referenced herein are trademarks of Hewlett-Packard Company in the United States and other countries. Other product and company names mentioned herein may be trademarks of their respective owners. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.13 (GNU/Linux) iEYEARECAAYFAlUMUjIACgkQ4B86/C0qfVkuCwCcC+h95jOOyvg4mWsqhdPSXYbV 9wEAniU7Opjr4sXaxMR+P0nqd3A6n+Zu =CQuO -----END PGP SIGNATURE-----

Trust: 2.79

sources: NVD: CVE-2014-7888 // JVNDB: JVNDB-2014-007962 // ZDI: ZDI-15-097 // BID: 72969 // VULHUB: VHN-75833 // PACKETSTORM: 130986 // PACKETSTORM: 130706

AFFECTED PRODUCTS

vendor:hpmodel:ole point of sale driverscope:lteversion:1.13.001

Trust: 1.0

vendor:hewlett packardmodel:hp dual serial usb thermal receipt printerscope: - version: -

Trust: 0.8

vendor:hewlett packardmodel:hp hybrid thermal printer with micrscope: - version: -

Trust: 0.8

vendor:hewlett packardmodel:hp opos driverscope:ltversion:1.13.003

Trust: 0.8

vendor:hewlett packardmodel:hp pusb thermal receipt printerscope: - version: -

Trust: 0.8

vendor:hewlett packardmodel:hp value pusb receipt printerscope: - version: -

Trust: 0.8

vendor:hewlett packardmodel:hp value serial usb receipt printerscope: - version: -

Trust: 0.8

vendor:hewlett packardmodel:pos printer windows and opos driversscope: - version: -

Trust: 0.7

vendor:hpmodel:ole point of sale driverscope:eqversion:1.13.001

Trust: 0.6

sources: ZDI: ZDI-15-097 // JVNDB: JVNDB-2014-007962 // CNNVD: CNNVD-201503-186 // NVD: CVE-2014-7888

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2014-7888
value: HIGH

Trust: 1.0

NVD: CVE-2014-7888
value: HIGH

Trust: 0.8

ZDI: CVE-2014-7888
value: MEDIUM

Trust: 0.7

CNNVD: CNNVD-201503-186
value: CRITICAL

Trust: 0.6

VULHUB: VHN-75833
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2014-7888
severity: HIGH
baseScore: 10.0
vectorString: AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

ZDI: CVE-2014-7888
severity: MEDIUM
baseScore: 6.8
vectorString: AV:N/AC:M/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 8.6
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.7

VULHUB: VHN-75833
severity: HIGH
baseScore: 10.0
vectorString: AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: ZDI: ZDI-15-097 // VULHUB: VHN-75833 // JVNDB: JVNDB-2014-007962 // CNNVD: CNNVD-201503-186 // NVD: CVE-2014-7888

PROBLEMTYPE DATA

problemtype:NVD-CWE-noinfo

Trust: 1.0

sources: NVD: CVE-2014-7888

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201503-186

TYPE

Unknown

Trust: 0.3

sources: BID: 72969

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2014-007962

EXPLOIT AVAILABILITY
sources:
            
            
            VULHUB: VHN-75833

PATCH
title:HPSBHF03279 SSRT101696url:http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c04583185
Trust: 0.8
title:Hewlett-Packard has issued an update to correct this vulnerability.url:https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay/?docId=emr_na-c04583185
Trust: 0.7
title:OPOS_CCOs_1.13.003url:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=54094
Trust: 0.6
sources:
            
            
            ZDI: ZDI-15-097 // 
            
            
            
            JVNDB: JVNDB-2014-007962 // 
            
            
            
            CNNVD: CNNVD-201503-186

EXTERNAL IDS
db:NVDid:CVE-2014-7888
Trust: 3.7
db:SECTRACKid:1031840
Trust: 1.7
db:JVNDBid:JVNDB-2014-007962
Trust: 0.8
db:ZDI_CANid:ZDI-CAN-2512
Trust: 0.7
db:ZDIid:ZDI-15-097
Trust: 0.7
db:CNNVDid:CNNVD-201503-186
Trust: 0.7
db:BIDid:72969
Trust: 0.3
db:PACKETSTORMid:130706
Trust: 0.2
db:PACKETSTORMid:130986
Trust: 0.2
db:VULHUBid:VHN-75833
Trust: 0.1
sources:
            
            
            ZDI: ZDI-15-097 // 
            
            
            
            VULHUB: VHN-75833 // 
            
            
            
            BID: 72969 // 
            
            
            
            JVNDB: JVNDB-2014-007962 // 
            
            
            
            PACKETSTORM: 130986 // 
            
            
            
            PACKETSTORM: 130706 // 
            
            
            
            CNNVD: CNNVD-201503-186 // 
            
            
            
            NVD: CVE-2014-7888

REFERENCES
url:https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docdisplay?docid=emr_na-c04583185
Trust: 1.7
url:http://www.securitytracker.com/id/1031840
Trust: 1.7
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-7888
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2014-7888
Trust: 0.8
url:https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docdisplay/?docid=emr_na-c04583185
Trust: 0.7
url:https://nvd.nist.gov/vuln/detail/cve-2014-7894
Trust: 0.2
url:https://nvd.nist.gov/vuln/detail/cve-2014-7897
Trust: 0.2
url:https://h20564.www2.hp.com/portal/site/hpsc/public/kb/
Trust: 0.2
url:https://h20564.www2.hp.com/portal/site/hpsc/public/kb/secbullarchive/
Trust: 0.2
url:http://h41183.www4.hp.com/signup_alerts.php?jumpid=hpsc_secbulletins
Trust: 0.2
url:https://nvd.nist.gov/vuln/detail/cve-2014-7890
Trust: 0.2
url:https://nvd.nist.gov/vuln/detail/cve-2014-7891
Trust: 0.2
url:http://www.hp.com
Trust: 0.2
url:https://nvd.nist.gov/vuln/detail/cve-2014-7895
Trust: 0.2
url:https://nvd.nist.gov/vuln/detail/cve-2014-7893
Trust: 0.2
url:https://nvd.nist.gov/vuln/detail/cve-2014-7889
Trust: 0.2
url:https://nvd.nist.gov/vuln/detail/cve-2014-7898
Trust: 0.2
url:https://nvd.nist.gov/vuln/detail/cve-2014-7892
Trust: 0.2
url:https://nvd.nist.gov/vuln/detail/cve-2014-7888
Trust: 0.2
sources:
            
            
            ZDI: ZDI-15-097 // 
            
            
            
            VULHUB: VHN-75833 // 
            
            
            
            JVNDB: JVNDB-2014-007962 // 
            
            
            
            PACKETSTORM: 130986 // 
            
            
            
            PACKETSTORM: 130706 // 
            
            
            
            CNNVD: CNNVD-201503-186 // 
            
            
            
            NVD: CVE-2014-7888

CREDITS
Ariele Caltabiano (kimiya)
Trust: 0.7
sources:
            
            
            ZDI: ZDI-15-097

SOURCES
db:ZDIid:ZDI-15-097
db:VULHUBid:VHN-75833
db:BIDid:72969
db:JVNDBid:JVNDB-2014-007962
db:PACKETSTORMid:130986
db:PACKETSTORMid:130706
db:CNNVDid:CNNVD-201503-186
db:NVDid:CVE-2014-7888

LAST UPDATE DATE
2025-04-12T23:13:08.199000+00:00

SOURCES UPDATE DATE
db:ZDIid:ZDI-15-097date:2015-03-12T00:00:00
db:VULHUBid:VHN-75833date:2019-10-09T00:00:00
db:BIDid:72969date:2015-03-04T00:00:00
db:JVNDBid:JVNDB-2014-007962date:2015-03-11T00:00:00
db:CNNVDid:CNNVD-201503-186date:2019-10-17T00:00:00
db:NVDid:CVE-2014-7888date:2025-04-12T10:46:40.837

SOURCES RELEASE DATE
db:ZDIid:ZDI-15-097date:2015-03-12T00:00:00
db:VULHUBid:VHN-75833date:2015-03-09T00:00:00
db:BIDid:72969date:2015-03-04T00:00:00
db:JVNDBid:JVNDB-2014-007962date:2015-03-11T00:00:00
db:PACKETSTORMid:130986date:2015-03-24T17:03:44
db:PACKETSTORMid:130706date:2015-03-09T20:17:05
db:CNNVDid:CNNVD-201503-186date:2015-03-10T00:00:00
db:NVDid:CVE-2014-7888date:2015-03-09T17:59:00.063