var-200604-0081
Vulnerability from variot

Directory traversal vulnerability in the HP Color LaserJet 2500 Toolbox and Color LaserJet 4600 Toolbox on Microsoft Windows before 20060402 allows remote attackers to read arbitrary files via a .. (dot dot) in an HTTP GET request to TCP port 5225. This issue is due to a failure in the application to properly sanitize user-supplied input. An attacker can exploit this vulnerability to retrieve arbitrary files from the vulnerable system in the context of the affected application. Information obtained may aid attackers in further attacks.

The vulnerability is caused due to an input validation error in the built-in HTTP server. This can be exploited to disclose the contents of arbitrary files via directory traversal attacks.

Example: http://[host]:5225/../../../[file]

SOLUTION: Update to version 3.1.

Subscribe: http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/

Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.

Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

Show details on source website

To clipboard 

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-200604-0081",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "color laserjet",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "hp",
        "version": "4600dtn"
      },
      {
        "model": "color laserjet",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "hp",
        "version": "4600dn"
      },
      {
        "model": "color laserjet",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "hp",
        "version": "4600hdn"
      },
      {
        "model": "color laserjet 4600 toolbox",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "hp",
        "version": "*"
      },
      {
        "model": "color laserjet 4600",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "hp",
        "version": "*"
      },
      {
        "model": "color laserjet 2500l",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "hp",
        "version": "*"
      },
      {
        "model": "color laserjet 2500",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "hp",
        "version": "*"
      },
      {
        "model": "color laserjet 2500n",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "hp",
        "version": "*"
      },
      {
        "model": "color laserjet 2500lse",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "hp",
        "version": "*"
      },
      {
        "model": "color laserjet 2500tn",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "hp",
        "version": "*"
      },
      {
        "model": "color laserjet 2500 toolbox",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "hp",
        "version": "*"
      },
      {
        "model": "color laserjet 4600",
        "scope": null,
        "trust": 0.6,
        "vendor": "hp",
        "version": null
      },
      {
        "model": "color laserjet 2500tn",
        "scope": null,
        "trust": 0.6,
        "vendor": "hp",
        "version": null
      },
      {
        "model": "color laserjet 2500lse",
        "scope": null,
        "trust": 0.6,
        "vendor": "hp",
        "version": null
      },
      {
        "model": "color laserjet 2500n",
        "scope": null,
        "trust": 0.6,
        "vendor": "hp",
        "version": null
      },
      {
        "model": "color laserjet 4600 toolbox",
        "scope": null,
        "trust": 0.6,
        "vendor": "hp",
        "version": null
      },
      {
        "model": "color laserjet 2500",
        "scope": null,
        "trust": 0.6,
        "vendor": "hp",
        "version": null
      },
      {
        "model": "color laserjet 2500l",
        "scope": null,
        "trust": 0.6,
        "vendor": "hp",
        "version": null
      },
      {
        "model": "color laserjet toolbox",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hp",
        "version": "46000"
      },
      {
        "model": "color laserjet toolbox",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hp",
        "version": "25000"
      }
    ],
    "sources": [
      {
        "db": "BID",
        "id": "17367"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200604-081"
      },
      {
        "db": "NVD",
        "id": "CVE-2006-1654"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Richard Horsman",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-200604-081"
      }
    ],
    "trust": 0.6
  },
  "cve": "CVE-2006-1654",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "nvd@nist.gov",
            "availabilityImpact": "NONE",
            "baseScore": 5.0,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 10.0,
            "id": "CVE-2006-1654",
            "impactScore": 2.9,
            "integrityImpact": "NONE",
            "severity": "MEDIUM",
            "trust": 1.0,
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
            "version": "2.0"
          }
        ],
        "cvssV3": [],
        "severity": [
          {
            "author": "nvd@nist.gov",
            "id": "CVE-2006-1654",
            "trust": 1.0,
            "value": "MEDIUM"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-200604-081",
            "trust": 0.6,
            "value": "MEDIUM"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-200604-081"
      },
      {
        "db": "NVD",
        "id": "CVE-2006-1654"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Directory traversal vulnerability in the HP Color LaserJet 2500 Toolbox and Color LaserJet 4600 Toolbox on Microsoft Windows before 20060402 allows remote attackers to read arbitrary files via a .. (dot dot) in an HTTP GET request to TCP port 5225. This issue is due to a failure in the application to properly sanitize user-supplied input. \nAn attacker can exploit this vulnerability to retrieve arbitrary files from the vulnerable system in the context of the affected application. Information obtained may aid attackers in further attacks. \n\nThe vulnerability is caused due to an input validation error in the\nbuilt-in HTTP server. This can be exploited to disclose the contents\nof arbitrary files via directory traversal attacks. \n\nExample:\nhttp://[host]:5225/../../../[file]\n\nSOLUTION:\nUpdate to version 3.1. \n\nSubscribe:\nhttp://secunia.com/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. \n\n----------------------------------------------------------------------\n\nUnsubscribe: Secunia Security Advisories\nhttp://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org\n\n----------------------------------------------------------------------\n\n\n",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2006-1654"
      },
      {
        "db": "BID",
        "id": "17367"
      },
      {
        "db": "PACKETSTORM",
        "id": "45198"
      }
    ],
    "trust": 1.26
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "BID",
        "id": "17367",
        "trust": 1.9
      },
      {
        "db": "SECUNIA",
        "id": "19529",
        "trust": 1.7
      },
      {
        "db": "SECTRACK",
        "id": "1015862",
        "trust": 1.6
      },
      {
        "db": "VUPEN",
        "id": "ADV-2006-1230",
        "trust": 1.6
      },
      {
        "db": "NVD",
        "id": "CVE-2006-1654",
        "trust": 1.6
      },
      {
        "db": "OSVDB",
        "id": "24396",
        "trust": 1.6
      },
      {
        "db": "FULLDISC",
        "id": "20060404 [SEC-1 LTD] HP COLOUR LASERJET 2500 AND 4600 TOOLBOX DIRECTORY TRAVERSAL VULNERABILITY",
        "trust": 0.6
      },
      {
        "db": "XF",
        "id": "25627",
        "trust": 0.6
      },
      {
        "db": "BUGTRAQ",
        "id": "20060404 [SEC-1 LTD] HP COLOUR LASERJET 2500 AND 4600 TOOLBOX DIRECTORY TRAVERSAL VULNERABILITY",
        "trust": 0.6
      },
      {
        "db": "HP",
        "id": "HPSBPI2109",
        "trust": 0.6
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200604-081",
        "trust": 0.6
      },
      {
        "db": "PACKETSTORM",
        "id": "45198",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "BID",
        "id": "17367"
      },
      {
        "db": "PACKETSTORM",
        "id": "45198"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200604-081"
      },
      {
        "db": "NVD",
        "id": "CVE-2006-1654"
      }
    ]
  },
  "id": "VAR-200604-0081",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VARIoT devices database",
        "id": null
      }
    ],
    "trust": 0.43333334
  },
  "last_update_date": "2024-11-23T23:03:33.158000Z",
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "NVD-CWE-Other",
        "trust": 1.0
      }
    ],
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2006-1654"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 1.6,
        "url": "http://securitytracker.com/id?1015862"
      },
      {
        "trust": 1.6,
        "url": "http://archives.neohapsis.com/archives/fulldisclosure/2006-04/0085.html"
      },
      {
        "trust": 1.6,
        "url": "http://www.securityfocus.com/bid/17367"
      },
      {
        "trust": 1.6,
        "url": "http://www.osvdb.org/24396"
      },
      {
        "trust": 1.6,
        "url": "http://secunia.com/advisories/19529"
      },
      {
        "trust": 1.0,
        "url": "http://www.securityfocus.com/archive/1/429984/100/0/threaded"
      },
      {
        "trust": 1.0,
        "url": "http://www.vupen.com/english/advisories/2006/1230"
      },
      {
        "trust": 1.0,
        "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/25627"
      },
      {
        "trust": 1.0,
        "url": "http://www.securityfocus.com/archive/1/429893/100/0/threaded"
      },
      {
        "trust": 0.6,
        "url": "http://www.securityfocus.com/archive/1/archive/1/429893/100/0/threaded"
      },
      {
        "trust": 0.6,
        "url": "http://www.frsirt.com/english/advisories/2006/1230"
      },
      {
        "trust": 0.6,
        "url": "http://xforce.iss.net/xforce/xfdb/25627"
      },
      {
        "trust": 0.6,
        "url": "http://www.securityfocus.com/archive/1/archive/1/429984/100/0/threaded"
      },
      {
        "trust": 0.3,
        "url": "http://h20000.www2.hp.com/bizsupport/techsupport/softwaredescription.jsp?lang=en\u0026cc=us\u0026prodtypeid=18972\u0026prodseriesid=81954\u0026switem=lj-39377-1\u0026prodnameid=81956\u0026swenvoid=228\u0026swlang=8\u0026taskid=135\u0026mode=3"
      },
      {
        "trust": 0.3,
        "url": "/archive/1/429984"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/secunia_security_advisories/"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/advisories/19529/"
      },
      {
        "trust": 0.1,
        "url": "http://itrc.hp.com/service/cki/docdisplay.do?docid=c00634759"
      },
      {
        "trust": 0.1,
        "url": "http://www.hp.com/go/clj2500_software"
      },
      {
        "trust": 0.1,
        "url": "http://[host]:5225/../../../[file]"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/product/9172/"
      },
      {
        "trust": 0.1,
        "url": "http://www.hp.com/go/clj4600_software"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/product/9173/"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/about_secunia_advisories/"
      }
    ],
    "sources": [
      {
        "db": "BID",
        "id": "17367"
      },
      {
        "db": "PACKETSTORM",
        "id": "45198"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200604-081"
      },
      {
        "db": "NVD",
        "id": "CVE-2006-1654"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "BID",
        "id": "17367"
      },
      {
        "db": "PACKETSTORM",
        "id": "45198"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200604-081"
      },
      {
        "db": "NVD",
        "id": "CVE-2006-1654"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2006-04-04T00:00:00",
        "db": "BID",
        "id": "17367"
      },
      {
        "date": "2006-04-06T18:10:32",
        "db": "PACKETSTORM",
        "id": "45198"
      },
      {
        "date": "2006-04-06T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-200604-081"
      },
      {
        "date": "2006-04-06T10:04:00",
        "db": "NVD",
        "id": "CVE-2006-1654"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2006-04-10T18:12:00",
        "db": "BID",
        "id": "17367"
      },
      {
        "date": "2006-04-07T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-200604-081"
      },
      {
        "date": "2024-11-21T00:09:24.437000",
        "db": "NVD",
        "id": "CVE-2006-1654"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-200604-081"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "HP Color LaserJet 2500/4600 Toolbox Directory Traversal Vulnerability",
    "sources": [
      {
        "db": "BID",
        "id": "17367"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200604-081"
      }
    ],
    "trust": 0.9
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "path traversal",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-200604-081"
      }
    ],
    "trust": 0.6
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.