HP Inc. has released firmware patches for a total of 54 printer models that have an arbitrary code bug.
The discovery was made by researchers at FoxGlove Security, who immediately notified HP of the issue. The vulnerability (CVE-2017-2750) allows arbitrary code execution and has a score of 8.1/10 on the Common Vulnerability Scoring System Scale.
Specifically, the researchers were able to reverse engineer and execute code on files with the .BDL extension used by the HP Solutions program. The .BDL extension is a binary extension that does not have an official manual for the general public.
They then managed to embed a .zip file inside the .bdl with the infected code. Although there was a problem with the signature validation, they addressed it (again by reverse engineering) by using an exact copy of the algorithm used in the signature validation.
Finally, after they uploaded the infected file to their own HP Solution software, they found that if someone downloaded it by performing a firmware update on their printer, they also downloaded the infected file.
At the same time, FoxGlove also mentions some other problems it identified:
- Bug which allows the attacker to access printer job queue data (Files that are waiting to be printed).
- Bug which allows the attacker to edit PostScript (PC's print content).
- Bug that causes the “Reset to factory settings” option to disable the admin password.
- Bug that extracts images from the printer.
- A bug that, although someone cannot directly load malware firmware onto the printer, can do so via .dll files.
The link below contains the corresponding fix patch via HP's official site.
https://support.hp.com/nz-en/document/c05839270
