CVE-2013-4615
published 2013-06-21CVE-2013-4615: The Canon MG3100, MG5300, MG6100, MP495, MX340, MX870, MX890, MX920, and MX922 printers allow remote attackers to cause a denial of service (device hang) via a…
PriorityP335medium5CVSS 2.0
AVNACLAuNCNINAP
EXPLOIT
EPSS
15.64%
96.4th percentile
The Canon MG3100, MG5300, MG6100, MP495, MX340, MX870, MX890, MX920, and MX922 printers allow remote attackers to cause a denial of service (device hang) via a crafted LAN_TXT24 parameter to English/pages_MacUS/cgi_lan.cgi followed by a direct request to English/pages_MacUS/lan_set_content.html. NOTE: the vendor has apparently responded by stating "Canon believes that its printers will not have to deal with unauthorized access to the network from an external location as long as the printers are used in a secured environment."
Detection & IOCsextracted from sources · hover to see the quote
- →Detect HTTP requests targeting the Canon printer CGI endpoint with a crafted LAN_TXT24 parameter, followed by a subsequent GET request to the lan_set_content.html page — this two-step sequence is the DoS trigger. ↗
- →Monitor for HTTP POST/GET requests to 'English/pages_MacUS/cgi_lan.cgi' on Canon printer management interfaces (typically port 80); anomalous or oversized LAN_TXT24 values should be flagged. ↗
- →A successful exploit results in a permanent device hang requiring a physical power cycle — sudden loss of printer HTTP management interface availability may indicate exploitation. ↗
- ·Canon's official position is that the vulnerability is only relevant if printers are exposed outside a secured/segmented network; however, any printer reachable from an untrusted network segment remains at risk. ↗
CVSS provenance
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
vendor_redhat5.0MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-x4pm-7m4x-8v58: The Canon MG3100, MG5300, MG6100, MP495, MX340, MX870, MX890, MX920, and MX922 printers allow remote attackers to cause a denial of service (device ha
ghsa_unreviewed·2022-05-17
CVE-2013-4615 [MEDIUM] CWE-20 GHSA-x4pm-7m4x-8v58: The Canon MG3100, MG5300, MG6100, MP495, MX340, MX870, MX890, MX920, and MX922 printers allow remote attackers to cause a denial of service (device ha
The Canon MG3100, MG5300, MG6100, MP495, MX340, MX870, MX890, MX920, and MX922 printers allow remote attackers to cause a denial of service (device hang) via a crafted LAN_TXT24 parameter to English/pages_MacUS/cgi_lan.cgi followed by a direct request to English/pages_MacUS/lan_set_content.html. NOTE: the vendor has apparently responded by stating "Canon believes that its printers will not have to deal with unauthorized access to the network from an external location as long as the printers are used in a secured environment."
Red Hat
pycadf: token leak to message queue
vendor_redhat·2014-05-20·CVSS 5.0
CVE-2014-4615 [MEDIUM] CWE-201 pycadf: token leak to message queue
pycadf: token leak to message queue
The notifier middleware in OpenStack PyCADF 0.5.0 and earlier, Telemetry (Ceilometer) 2013.2 before 2013.2.4 and 2014.x before 2014.1.2, Neutron 2014.x before 2014.1.2 and Juno before Juno-2, and Oslo allows remote authenticated users to obtain X_AUTH_TOKEN values by reading the message queue (v2/meters/http.request).
It was found that authentication tokens were not properly sanitized from the message queue by the notifier middleware. An attacker with read access to the message queue could possibly use this flaw to intercept an authentication token and gain elevated privileges. Note that all services using the notifier middleware configured after the auth_token middleware pipeline were affected.
Package: openstack-ceilometer (Red Hat Enterprise Linux
No detection rules found.
http://archives.neohapsis.com/archives/fulldisclosure/2013-06/0146.htmlhttp://www.mattandreko.com/2013/06/canon-y-u-no-security.htmlhttps://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/dos/http/canon_wireless_printer.rbhttp://archives.neohapsis.com/archives/fulldisclosure/2013-06/0146.htmlhttp://www.mattandreko.com/2013/06/canon-y-u-no-security.htmlhttps://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/dos/http/canon_wireless_printer.rb
2013-06-21
Published