sb-nz logo
Story image

PrinterLogic software vulnerable to remote attacks

09 May 2019

Businesses that use PrinterLogic Print Management Software should look at using an ‘always’ on VPN to avoid potential attacks on workstations. On May 3, Carnegie Mellon University’s CERT Coordination Center posted details about three vulnerabilities that affect the PrinterLogic Print Management Software. The vulnerabilities affect PrinterLogic versions 18.3.1.96 and older. 

According to the vulnerability report, the software does not validate SSL and software update certificates, which means attackers could take control of the software, and reconfigure the code.
This is part of vulnerability CVE-2018-5408. The vulnerability report notes the following:

“The PrinterLogic Print Management software does not validate, or incorrectly validates, the PrinterLogic management portal's SSL certificate. When a certificate is invalid or malicious, it might allow an attacker to spoof a trusted entity by using a man-in-the-middle (MITM) attack. The software might connect to a malicious host while believing it is a trusted host, or the software might be deceived into accepting spoofed data that appears to originate from a trusted host.”

Another vulnerability, CVE-2018-5409 can take over the host server.

“PrinterLogic Print Management software updates and executes the code without sufficiently verifying the origin and integrity of the code. An attacker can execute malicious code by compromising the host server, performing DNS spoofing, or modifying the code in transit.”

CVE-2019-9505 states that “PrinterLogic Print Management software does not sanitise special characters allowing for remote unauthorized changes to configuration files.”
In all cases, an attacker could remotely execute arbitrary code with system privileges.

The report recommends that users should update the PrinterLogic Print Management Software when patches are available. However, PrinterLogic has not yet released any patches. A statement from the Canadian Centre for Cyber Security indicates that a patch is currently in development.

“Consider using 'always on' VPN to prevent some of the MITM scenarios and enforce application whitelisting on the endpoint to prevent the PrinterLogic agent from executing malicious code,” the report concludes.

Story image
Got crypto? Pay tax – A quick look at IR's new crypto-asset guidance
Inland Revenue's new guidance aims to provide more certainty for New Zealand taxpayers who hold crypto-assets, and to help people ‘get things right from the start’.More
Story image
SMBs seeking service providers in face of rising cyber threats
SMBs are struggling with their cybersecurity solutions, with three quarters worried about being the target of a cyberattack in the next six months, and 91% considering using or switching to a new IT service provider if offered a better option.More
Story image
Kaspersky releases new report on consumer’s approach to digital services
COVID-19 related restrictions and the necessity to stay indoors has influenced the way people approach digital services, making them more aware of how securely both they, and their housemates, use the internet.More
Story image
Exabeam and Code42 partner up to launch insider threat solution
The solution will give customers a fuller picture of their environment, and will leverage automated incident response to obstruct insider threat before data loss occurs.More
Story image
Phishing scam imitates SharePoint & OneNote for nefarious clicks
Sophos researchers say that the attackers take a slightly different approach to the standard ‘fake login’ phishing email.More
Link image
How to better protect your organisation's most valuable asset - its data.
Data resilience strategies are becoming increasingly critical in relation to the skyrocketing value of data and the proliferation of malicious entities wishing to steal it.More