Notified:  February 10, 2015 Updated: March 20, 2015

Statement Date:   March 20, 2015

Status

Affected

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

Previous generations of HP printing products may use an implementation of mDNS for device discovery on the network which allows detection outside the local network segment. While this implementation is not recommended by RFC 6762 Section 5.5, it is allowed within the specification. HP’s networking infrastructure for its current device fleet uses an Apple Bonjour implementation with Bonjour. For customers concerned with mDNS use on their network, HP recommends filtering mDNS on UDP Port 5353 at the network perimeter.  If desired the customer can manually disable mDNS on supported products using the embedded web server (EWS) configuration functionality (such as the Color LaserJet 4700, Figure A), however this may impact device discovery features including AirPrint, Mopria, and Google Cloud Print 2.0.

Notified:  February 10, 2015 Updated: March 31, 2015

Statement Date:   February 17, 2015

Status

Affected

Vendor Statement

"IBM i is not impacted as we do not support mDNS."

Vendor Information

IBM i does not support mDNS according to the vendor, however IBM has released an advisory for their Security Access Manager product (CVE-2015-1892 ; see URL below).

Vendor References

• http://www-01.ibm.com/support/docview.wss?uid=swg21699497

Notified:  February 10, 2015 Updated: March 31, 2015

Statement Date:   February 16, 2015

Status

Affected

Vendor Statement

This vulnerability "has been patched already since 2011 (DSM 3.1 & later versions). ... Despite of that, we will still upgrade avahi to 0.6.31 on the latest DSM 5.2 beta release and further versions."

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Addendum

While recent versions do not appear vulnerable, if you are running old software, please update to the latest version.