BugTraq
Canon ImageRunner reveals SMB, IPX, and FTP username/passwords Sep 05 2006 11:10PM
gunrnr earthlink net (2 replies)
The Canon ImageRunner multi-function device?s Remote UI web interface software will reveal username and password pairs contained in address book entries when the address book is exported. These address book entries are used for scanning to SMB, FTP, or IPX shares. In addition, passwords for password protected fax entries will be revealed.

This security flaw was brought to Canon's attention through its vendor Ikon. Canon's recommendation is to enable the system manager ID to restrict access to the web interface. However, this is a limited security measure for if there are users that have access to that portion of the web interface but shouldn't have access to the usernames and passwords stored in the device, this will not protect against such. Also, if the system manager ID and password is compromised it will make accessible the user names and password pairs stored on the device.

Tested and verified on Canon iR C3220, iR 5020, iR9070, iR C6800, iR C6870, and iR 8500. Also, machines running the Fiery software have the same exploit as the Fiery software works in conjunction with the Remote UI software. As the Remote UI software is the same across many machines, it is likely that the problem exists in all devices running Remote UI.

Following is an example of an exported address book:

===

# Canon AddressBook version: 1

# CharSet: WCP1252

# SubAddressBookName:

dn: 201

cn: FTP address

cnread: FTP address

url: ftp.myftpserver.com

path: ftpdir/

username: foo

pwd: bar

accesscode: 0

protocol: ftp

objectclass: top

objectclass: extensibleobject

objectclass: remotefilesystem

dn: 202

cn: Fax address

cnread: Fax address

dialdata: 5551212

pwd: 123456789

txstartspeed: 33600

commode: domestic

lineselect: auto

faxprotocol: g4

accesscode: 0

protocol: t30

objectclass: top

objectclass: extensibleobject

objectclass: g3fax

dn: 203

cn: SMB address

cnread: SMB address

url: smb.mysmbserver.com

path: pathtoshare/

username: foo

pwd: bar

accesscode: 0

protocol: smb

objectclass: top

objectclass: extensibleobject

objectclass: remotefilesystem

dn: 204

cn: IPX Address

cnread: IPX Address

url: ipx.myipxserver.com

path: pathtoshare/

username: foo

pwd: bar

accesscode: 0

protocol: ipx

objectclass: top

objectclass: extensibleobject

objectclass: remotefilesystem

===

-GR

[ reply ]
RE: Canon ImageRunner reveals SMB, IPX, and FTP username/passwords Sep 28 2006 01:08PM
Jill George (jgeorge vlct org)
Re: Canon ImageRunner reveals SMB, IPX, and FTP username/passwords Sep 07 2006 10:58AM
Doug Atkins (d atkins1 gmail com)


 

Privacy Statement
Copyright 2010, SecurityFocus