search menu icon-carat-right cmu-wordmark

CERT Coordination Center

HP Photosmart B210 printer SMB server buffer overflow vulnerability

Vulnerability Note VU#840844

Original Release Date: 2015-10-21 | Last Revised: 2015-10-21

Overview

The HP Photosmart B210 printer utilizes an SMB server for managing the print queue. An invalid SMB packet may cause a denial of service condition, requiring the printer to be restarted.

Description

Fuzzing the first 296 bytes of an SMB packet may in some cases cause a denial of service condition on the HP Photosmart B210 printer. This is a persistent denial of service that requires the printer to be manually restarted to resume normal operations.

HP has released the following statement:

    "HP has examined this issue reported on the Photosmart B210 and has verified the printer could become unresponsive when fuzzed with the code provided. At no time did we identify buffer overflows with this tool nor our code inspection. The attempted attack produces a non-permanent denial of service.

    HP's recommendation for existing models affected by this attack is to power cycle the device to return it to a working state.

    HP continually works to improve security and is taking steps to ensure current and future products are not susceptible to this attack."

The underlying cause of the crash remains unclear.

Impact

An unauthenticated user on the same network as the printer may be able to cause a persistent denial of service, requiring the printer to be restarted to regain functionality.

Solution

The CERT/CC is currently unaware of a full solution to this problem. However, the following advice may be useful.

Power cycle the printer

HP points out that the printer will resume normal function after a power cycle.

Vendor Information

840844
 
Affected   Unknown   Unaffected

Hewlett-Packard Company

Notified:  August 24, 2015 Updated:  October 02, 2015

Statement Date:   September 30, 2015

Status

  Affected

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.


CVSS Metrics

Group Score Vector
Base 6.1 AV:A/AC:L/Au:N/C:N/I:N/A:C
Temporal 5.8 E:F/RL:U/RC:C
Environmental 4.4 CDP:ND/TD:M/CR:ND/IR:ND/AR:ND

References

Credit

Thanks to Avery Raaymakers for reporting this vulnerability.

This document was written by Garret Wassermann.

Other Information

CVE IDs: None
Date Public: 2015-10-21
Date First Published: 2015-10-21
Date Last Updated: 2015-10-21 20:09 UTC
Document Revision: 25

Sponsored by the Department of Homeland Security Office of Cybersecurity and Communications.