Canon ImageRunner reveals SMB, IPX, and FTP usernamepasswords

Document Sample
Canon ImageRunner reveals SMB, IPX, and FTP usernamepasswords Powered By Docstoc
					                Canon ImageRunner reveals SMB, IPX, and FTP username/passwords

Canon ImageRunner reveals SMB, IPX, and FTP
username/passwords

Source: http://www.derkeiler.com/Mailing−Lists/securityfocus/bugtraq/2006−09/msg00069.html



      • From: gunrnr@xxxxxxxxxxxxx
      • Date: 5 Sep 2006 23:10:42 −0000

The Canon ImageRunner multi−function device?s Remote UI web interface software will reveal username
and password pairs contained in address book entries when the address book is exported. These address book
entries are used for scanning to SMB, FTP, or IPX shares. In addition, passwords for password protected fax
entries will be revealed.

This security flaw was brought to Canon's attention through its vendor Ikon. Canon's recommendation is to
enable the system manager ID to restrict access to the web interface. However, this is a limited security
measure for if there are users that have access to that portion of the web interface but shouldn't have access to
the usernames and passwords stored in the device, this will not protect against such. Also, if the system
manager ID and password is compromised it will make accessible the user names and password pairs stored
on the device.

Tested and verified on Canon iR C3220, iR 5020, iR9070, iR C6800, iR C6870, and iR 8500. Also, machines
running the Fiery software have the same exploit as the Fiery software works in conjunction with the Remote
UI software. As the Remote UI software is the same across many machines, it is likely that the problem exists
in all devices running Remote UI.

Following is an example of an exported address book:

===
# Canon AddressBook version: 1
# CharSet: WCP1252
# SubAddressBookName:

dn: 201
cn: FTP address
cnread: FTP address
url: ftp.myftpserver.com
path: ftpdir/
username: foo
pwd: bar
accesscode: 0
protocol: ftp
objectclass: top
objectclass: extensibleobject
objectclass: remotefilesystem

dn: 202

Canon ImageRunner reveals SMB, IPX, and FTP username/passwords                                                  1
                Canon ImageRunner reveals SMB, IPX, and FTP username/passwords
cn: Fax address
cnread: Fax address
dialdata: 5551212
pwd: 123456789
txstartspeed: 33600
commode: domestic
lineselect: auto
faxprotocol: g4
accesscode: 0
protocol: t30
objectclass: top
objectclass: extensibleobject
objectclass: g3fax

dn: 203
cn: SMB address
cnread: SMB address
url: smb.mysmbserver.com
path: pathtoshare/
username: foo
pwd: bar
accesscode: 0
protocol: smb
objectclass: top
objectclass: extensibleobject
objectclass: remotefilesystem

dn: 204
cn: IPX Address
cnread: IPX Address
url: ipx.myipxserver.com
path: pathtoshare/
username: foo
pwd: bar
accesscode: 0
protocol: ipx
objectclass: top
objectclass: extensibleobject
objectclass: remotefilesystem
===

−GR




Canon ImageRunner reveals SMB, IPX, and FTP username/passwords                   2

				
DOCUMENT INFO
Shared By:
Categories:
Stats:
views:37
posted:1/14/2010
language:English
pages:2