| Summary | The flood-protection feature in the base, IPDS DLE, Forms DLE, Barcode DLE, Prescribe DLE, and Printcryption DLE components on certain Lexmark laser and inkjet printers and MarkNet devices allows remote attackers to cause a denial of service (TCP outage) by making many passive FTP connections and then aborting these connections. |
|---|---|
| Summary | Per: http://support.lexmark.com/index?page=content&id=TE85&locale=EN&userlocale=EN_US#Printcryption 'Details Lexmark products have connection flood protection mechanisms that limit the number of simultaneous network connections that can be made to the device on most TCP service ports. (21/FTP 79/Finger, 515/LPD, 631/IPP, 5001, 9100-9104, 9200, 9300, 9400, 9500-9501 & 9600) The FTP service exception handler does not properly maintain the state of the flood protection when passive FTP connections are aborted. Once a sufficient number of passive FTP connections have timed out (typically 15), the flood protection is enabled and is never reset. The flood protection can be reset by resetting the network adapter, or by power cycling the device. The firmware update that resolves this vulnerability automatically resets the flood protection after the “Network Job Timeout” has expired or 90 seconds if the “Network Job Timeout” is disabled.' |
| Publication Date | March 25, 2010, 7:45 a.m. |
| Registration Date | Jan. 29, 2021, 10:57 a.m. |
| Last Update | Oct. 11, 2018, 4:53 a.m. |
| CVSS2.0 : MEDIUM | |
| Score | 5.0 |
|---|---|
| Vector | AV:N/AC:L/Au:N/C:N/I:N/A:P |
| 攻撃元区分(AV) | ネットワーク |
| 攻撃条件の複雑さ(AC) | 低 |
| 攻撃前の認証要否(Au) | 不要 |
| 機密性への影響(C) | なし |
| 完全性への影響(I) | なし |
| 可用性への影響(A) | 低 |
| Get all privileges. | いいえ |
| Get user privileges | いいえ |
| Get other privileges | いいえ |
| User operation required | いいえ |
| Configuration1 | or higher | or less | more than | less than | |
| cpe:2.3:h:lexmark:z2420:*:*:*:*:*:*:*:* | |||||
| Title | 特定の Lexmark レーザープリンタのフラッド保護機能におけるサービス運用妨害 (DoS) の脆弱性 |
|---|---|
| Summary | 特定の Lexmark レーザー、インクジェットプリンタ、および MarkNet デバイスのベース、IPDS DLE、Forms DLE、Barcode DLE、Prescribe DLE、および Printcryption DLE コンポーネントのフラッド保護機能には、サービス運用妨害 (TCP 機能停止) 状態となる脆弱性が存在します。 |
| Possible impacts | 第三者により、多数のパッシブ FTP 接続を行い、その接続を中止されることで、サービス運用妨害 (TCP 機能停止) 状態にされる可能性があります。 |
| Solution | ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。 |
| Publication Date | March 18, 2010, midnight |
| Registration Date | Sept. 25, 2012, 5:38 p.m. |
| Last Update | Sept. 25, 2012, 5:38 p.m. |
| Lexmark |
| Z2420 |
| No | Changed Details | Date of change |
|---|---|---|
| 0 | [2012年09月25日] 掲載 |
Feb. 17, 2018, 10:37 a.m. |