HP MFP Digital Sending Software < 4.18.3 Local Unspecified Authentication Bypass

This script is Copyright (C) 2010-2013 Tenable Network Security, Inc.


Synopsis :

The remote Windows host contains an application that is affected by
an authentication bypass vulnerability.

Description :

The remote Windows host contains a version of HP MFP Digital Sending
Software earlier than 4.18.3. Such versions are potentially affected
by an unspecified authentication bypass vulnerability.

A local attacker, exploiting this flaw, reportedly can gain
unauthorized access to 'Send to email' and other functionalities of an
HP Multifunction Peripheral (MFP) that is controlled by the HP Digital
Sending Software.

See also :

http://www.securityfocus.com/archive/1/511283/30/0/threaded
http://www.securityfocus.com/archive/1/511825/30/0/threaded

Solution :

Upgrade to HP MFP Digital Sending Software 4.18.5 or later.

Note that HP initially recommended upgrading to version 4.18.3. While
that version does address the vulnerability, it also introduces a
non-security defect and HP now recommends upgrading to version 4.18.5.

Risk factor :

Medium / CVSS Base Score : 4.7
(CVSS2#AV:L/AC:M/Au:N/C:C/I:N/A:N)
CVSS Temporal Score : 3.5
(CVSS2#E:U/RL:OF/RC:C)
Public Exploit Available : false

Family: Windows

Nessus Plugin ID: 46676 (hp_mfp_dss_4_18_3.nasl)

Bugtraq ID: 40147

CVE ID: CVE-2010-1558

Ready to Amp Up Your Nessus Experience?

Get Nessus Professional to scan unlimited IPs, run compliance checks & more

Buy Nessus Professional Now