Home page logo

fulldisclosure logo Full Disclosure mailing list archives

DDIVRT-2008-19 HP JetDirect Web Administration Directory Traversal
From: "DDI_Vulnerability_Alert" <DDI.VulnerabilityAlert () ddifrontline com>
Date: Wed, 4 Feb 2009 08:40:50 -0600



DDIVRT-2008-19 HP JetDirect Web Administration Directory Traversal






Date Discovered


October 23, 2008


Discovered By


Digital Defense, Inc. Vulnerability Research Team

Credit: Shmoov and r () b13$


Vulnerability Description


The HP-ChaiSOE/1.0 embedded web server on certain HP JetDirect printers
allows a potential attacker to gain read only access to directories and
files outside of the web root.  An attacker can leverage this flaw to
read arbitrary system configuration files, cached documents, etc.
Information obtained from an affected host may facilitate further
attacks against the host.  Exploitation of this flaw is trivial using
common web server directory traversal techniques.


Solution Description


The vendor has released an update.  See
01623905 for more details.

Digital Defense, Inc. recommends restricting access to the HP JetDirect
web administration interface to authorized hosts only.


Tested Systems / Software (with versions)


Embedded web server HP-ChaiSOE/1.0 on:

      HP JetDirect 2420

      HP JetDirect 4250



Vendor Contact




Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

  By Date           By Thread  

Current thread:
  • DDIVRT-2008-19 HP JetDirect Web Administration Directory Traversal DDI_Vulnerability_Alert (Feb 04)
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]