=20 SEC-1 LTD
=20 www.sec-1.com

=20 Security Advisory

Advisory Name: HP Colour LaserJet 2500 and 4600 Toolbox Directory=20
=09 Traversal Vulnerability

=20Release Date: 04/04/2006
=20 Application: HP Colour LaserJet 2500 and 4600 Toolbox
=20 Platform: Microsoft Windows (all supported versions)
=20 Severity: Remote Arbitrary File Access
=20 Author: Richard Horsman
Vendor Status: Fixed
CVE Candidate: Pending
=20 Reference: http://www.sec-1.com


Overview:=20

The HP Colour LaserJet 2500 and 4600 Toolbox provides links to printer
status=20
information, help information and tools for diagnosing and solving
problems.=20


Vulnerability Details:=20

Sec-1 has identified a security vulnerability within the HP Colour
LaserJet=20
2500 and 4600 Toolbox software which could allow unauthorised access to
the=20
file system.

The vulnerable process hosts a HTTP interface on TCP port 5225 and is=20
susceptible to directory traversal. An attacker would have access to any
file
the logged on user has access to within the affected file system.


Exploit:

To exploit this issue:

The following request would attempt to retrieve the c:\boot.ini file via

a standard web browser.

http://<target>:5225/../../../boot.ini

This will retrieve the boot.ini file from the affected host.

Vendor Response:

HP has made the "HP Colour LaserJet 2500/4600 Software Update"=20
version 3.1 available to resolve the issue.

The software update can be downloaded as follows:

For the HP Colour LaserJet 2500

=20 1. Browse to

=20 http://www.hp.com/go/clj2500_software
=20 2. Select ">>Download Drivers and Software"
=20 3. Under "Select your product" choose the printer model.
=20 4. Under "Select operating system" choose the operating system.
=20 5. Download the "HP Colour LaserJet 2500/4600 Software Update"
=20 version 3.1
=20 6. Follow the download instructions presented on the "HP Colour
=20 LaserJet 2500/4600 Software Update" download page to run
=20 the update.

For the HP Colour LaserJet 4600

=20 1. Browse to

=20 http://www.hp.com/go/clj4600_software
=20 2. Under "Select your product" choose the printer model.
=20 3. Under "Select operating system" choose the operating system.
=20 4. Download the "HP Colour LaserJet 2500/4600 Software Update"
=20 version 3.1
=20 5. Follow the download instructions presented on the "HP Colour
=20 LaserJet 2500/4600 Software Update" download page to run the=20
=09update.

Sec-1 specialises in the provision of network security solutions. For mor=
e information on products and services we offer visit www.sec-1.com or ca=
ll 0113 257 8955.