製品・ソフトウェアに関する情報

JVN脆弱性詳細

複数の Canon プリンタにおけるサービス運用妨害 (DoS) の脆弱性

Title	複数の Canon プリンタにおけるサービス運用妨害 (DoS) の脆弱性
Summary	複数の Canon プリンタには、サービス運用妨害 (デバイスハング) 状態にされる脆弱性が存在します。
Possible impacts	第三者により、English/pages_MacUS/lan_set_content.html へのダイレクトリクエスト (direct request) に続いて実行される English/pages_MacUS/cgi_lan.cgi の巧妙に細工された LAN_TXT24 パラメータを介して、サービス運用妨害 (デバイスハング) 状態にされる可能性があります。
Solution	ベンダ情報および参考情報を参照して適切な対策を実施してください。
Publication Date	June 18, 2013, midnight
Registration Date	June 25, 2013, 4:12 p.m.
Last Update	June 25, 2013, 4:12 p.m.

Affected System

キヤノン

PIXMA MP495

PIXMA MX340

PIXMA MX920

PIXMA MX922

PIXUS MG3130

PIXUS MG5330

PIXUS MG6130

PIXUS MX870

PIXUS MX893

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2013-4615	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4615
National Vulnerability Database (NVD)
2	CVE-2013-4615	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-4615

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-20	https://jvndb.jvn.jp/ja/cwe/CWE-20.html

ベンダー情報

No	Name	URL
Canon
1	PIXUS 商品一覧	http://cweb.canon.jp/pixus/lineup/

その他

No	Name	URL
関連文書
1	Canon, Y U NO Security?	http://www.mattandreko.com/2013/06/canon-y-u-no-security.html
2	rapid7 / metasploit-framework / modules / auxiliary / dos / http / canon_wireless_printer.rb	https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/dos/http/canon_wireless_printer.rb

Change Log

No	Changed Details	Date of change
0	[2013年06月25日] 掲載	Feb. 17, 2018, 10:37 a.m.

NVD Vulnerability Information

CVE-2013-4615

Summary	The Canon MG3100, MG5300, MG6100, MP495, MX340, MX870, MX890, MX920, and MX922 printers allow remote attackers to cause a denial of service (device hang) via a crafted LAN_TXT24 parameter to English/pages_MacUS/cgi_lan.cgi followed by a direct request to English/pages_MacUS/lan_set_content.html. NOTE: the vendor has apparently responded by stating "Canon believes that its printers will not have to deal with unauthorized access to the network from an external location as long as the printers are used in a secured environment."
Publication Date	June 22, 2013, 6:55 a.m.
Registration Date	Jan. 26, 2021, 3:43 p.m.
Last Update	Nov. 21, 2024, 10:55 a.m.

Affected software configurations

Related information, measures and tools

No	URL	refsource	タグ
1	http://archives.neohapsis.com/archives/fulldisclosure/2013-06/0146.html
2	http://archives.neohapsis.com/archives/fulldisclosure/2013-06/0146.html
3	http://www.mattandreko.com/2013/06/canon-y-u-no-security.html
4	http://www.mattandreko.com/2013/06/canon-y-u-no-security.html
5	https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/dos/http/canon_wireless_printer.rb
6	https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/dos/http/canon_wireless_printer.rb

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-20	不適切な入力確認	https://cwe.mitre.org/data/definitions/20.html