[11478] in bugtraq
OCE' 9400 plotters
daemon@ATHENA.MIT.EDU (Larry W. Cashdollar)
Sat Aug 21 21:16:00 1999
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Content-Md5: 2AYu9vmNZsbzYKLWpsZzOQ==
Message-Id: <199908191803.OAA18769@beanie.Biw.COM>
Date: Thu, 19 Aug 1999 14:03:32 -0400
Reply-To: "Larry W. Cashdollar" <lwcashd@BIW.COM>
From: "Larry W. Cashdollar" <lwcashd@BIW.COM>
X-To: bugtraq@securityfocus.com
To: BUGTRAQ@SECURITYFOCUS.COM
Aleph1,
I apologize if this has be brought up before, but with the recent
post concerning the QMS 2060 printers and the length of time I have sat on this
(4 months) I figured it should be released. I sent this information to OCE long
ago with no response. I am aware of the Intelligent Peripherals bulletin by
CIAC.
http://www.ciac.org/ciac/bulletins/j-019.shtml
I have a few plotters / printers under my audit umbrella and
noticed something interesting on an Oce' 9400 plotter. The printer has the
ability to be a telnet proxy. Where as a user can hop via telnet to other
hosts. If the printer is not setup properly the connections will go unlogged.
bunyip% telnet JPP1
Trying 192.168.38.244...
Connected to JPP1.
Escape character is '^]'.
Network Printer Server Version 5.6.3 (192.168.38.244)
login: root
Password:[Just enter here]
Welcome root user
WARNING: current and stored values differ.
Use 'list diff' command to find the differences.
Current values will be lost if unit is reset.
192.168.38.244:root> telnet 192.168.38.110
trying 192.168.38.110 ...
Connected to 192.168.38.110
Escape character is '0x18'
Red Hat Linux release 5.9 (Starbuck)
Kernel 2.2.3-5 on an i586
login:
192.168.38.244:root> list sysinfo
name:
contact:
location:
version: 5.6.3
serial number: 13029
compiled: Mar 25 1998 loginfo: sys
logport:
syslog: 255.255.255.255
email: NetPrint@<unconfigured>
dns server: 192.168.38.110
module: novell, appletalk, netbios
checksum: 1E54
All that is needed is a valid DNS server setup in the plotter
configuration.
192.168.38.244:root> set sysinfo dns 192.168.38.100
And anyone can use the plotter as an anonymous telnet proxy.
Fix:
Enable passwords for the accounts on the plotter:
syntax: set user add <NAME>
set user del <NAME>
set user passwd <NAME> [<PASSWORD>]
set user type <NAME> root|guest
set user from default|stored
Enable logging:
syntax: set logpath <LOGPATH> name <NEW_NAME>
set logpath <LOGPATH> type [[-]job] [[-]user] [[-]pgcnt] [[-]cksum]
[[-]printer] [[-]ioport]
set logpath <LOGPATH> port <TCP-PORT>|email|syslog
set logpath from default|stored
P.S. This plotter has ping functionality also. No, I have not tried DoS attacks
=)
syntax: ping [-s] <IPNAME> [<DATASZ> [<NUMPKTS>]]
-- Larry W. Cashdollar
Unix Administrator
Security Operations
