Story image

PrinterLogic software vulnerable to remote attacks

09 May 2019

Businesses that use PrinterLogic Print Management Software should look at using an ‘always’ on VPN to avoid potential attacks on workstations. On May 3, Carnegie Mellon University’s CERT Coordination Center posted details about three vulnerabilities that affect the PrinterLogic Print Management Software. The vulnerabilities affect PrinterLogic versions 18.3.1.96 and older. 

According to the vulnerability report, the software does not validate SSL and software update certificates, which means attackers could take control of the software, and reconfigure the code.
This is part of vulnerability CVE-2018-5408. The vulnerability report notes the following:

“The PrinterLogic Print Management software does not validate, or incorrectly validates, the PrinterLogic management portal's SSL certificate. When a certificate is invalid or malicious, it might allow an attacker to spoof a trusted entity by using a man-in-the-middle (MITM) attack. The software might connect to a malicious host while believing it is a trusted host, or the software might be deceived into accepting spoofed data that appears to originate from a trusted host.”

Another vulnerability, CVE-2018-5409 can take over the host server.

“PrinterLogic Print Management software updates and executes the code without sufficiently verifying the origin and integrity of the code. An attacker can execute malicious code by compromising the host server, performing DNS spoofing, or modifying the code in transit.”

CVE-2019-9505 states that “PrinterLogic Print Management software does not sanitise special characters allowing for remote unauthorized changes to configuration files.”
In all cases, an attacker could remotely execute arbitrary code with system privileges.

The report recommends that users should update the PrinterLogic Print Management Software when patches are available. However, PrinterLogic has not yet released any patches. A statement from the Canadian Centre for Cyber Security indicates that a patch is currently in development.

“Consider using 'always on' VPN to prevent some of the MITM scenarios and enforce application whitelisting on the endpoint to prevent the PrinterLogic agent from executing malicious code,” the report concludes.

Container survey shows adoption accelerating while security concerns remain top of mind
The report features insights from over 500 IT professionals.
Google 'will do better' after G Suite passwords exposed since 2005
Fourteen years is a long time for sensitive information like usernames and passwords to be sitting ducks, unencrypted and at risk of theft and corruption.
Hackbusters! Reviewing 90 days of cybersecurity incident response cases
While there are occasionally very advanced new threats, these are massively outnumbered by common-or-garden email fraud, ransomware attacks and well-worn old exploits.
SEGA turns to Palo Alto Networks for cybersecurity protection
When one of the world’s largest video game pioneers wanted to strengthen its IT defences against cyber threats, it started with firewalls and real-time threat intelligence from Palo Alto Networks.
Forrester names Trend Micro Leader in email security
TrendMicro earned the highest score for technology leadership, deployment options and cloud integration.
LogRhythm releases cloud-based SIEM solution
LogRhythm Cloud provides the same feature set and user experience as its on-prem experience.
One Identity named Leader in PAM and IAM by KuppingerCole
KuppingerCole lead analyst Anmol Singh evaluated the strengths and weaknesses of 20 solution providers in the PAM market for the report.
Healthcare environments difficult to secure - Forescout
The convergence of IT, Internet of Things (IoT) and operational technology (OT) makes it more difficult for the healthcare industry to manage a wide array of hard-to-control network security risks.