Lexmark MarkVision Enterprise < 2.1 Multiple Vulnerabilities

critical Nessus Plugin ID 80203

Synopsis

The remote web application is affected by multiple vulnerabilities.

Description

The version of Lexmark MarkVision Enterprise installed on the remote host is prior to 2.1.0. It is, therefore, affected by the following vulnerabilities :

- A remote code execution vulnerability due to improper handling of user input to the 'GfdFileUploadServerlet' servlet. (CVE-2014-8741)

- An information disclosure vulnerability due to improper handling of user input to the 'ReportDownloadServlet' servlet. (CVE-2014-8742)

Solution

Upgrade to Lexmark MarkVision Enterprise 2.1.0 or later.

See Also

http://support.lexmark.com/index?page=content&id=TE667&locale=en&userlocale=EN_US

https://www.zerodayinitiative.com/advisories/ZDI-14-411/

https://www.zerodayinitiative.com/advisories/ZDI-14-410/

http://support.lexmark.com/index?page=content&id=TE666&locale=en&userlocale=EN_US

Plugin Details

Severity: Critical

ID: 80203

File Name: lexmark_markvision_enterprise_2_1.nasl

Version: 1.7

Type: remote

Family: Misc.

Published: 12/22/2014

Updated: 11/15/2018

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: High

Score: 7.4

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 8.3

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Vulnerability Information

CPE: cpe:/a:lexmark:markvision

Required KB Items: www/lexmark_markvision_enterprise

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 12/9/2014

Vulnerability Publication Date: 12/9/2014

Exploitable With

Metasploit (Lexmark MarkVision Enterprise Arbitrary File Upload)

Elliot (Lexmark MarkVision Enterprise 2.0 File Upload)

Reference Information

CVE: CVE-2014-8741, CVE-2014-8742

BID: 71623, 71625