Story image

PrinterLogic software vulnerable to remote attacks

09 May 2019

Businesses that use PrinterLogic Print Management Software should look at using an ‘always’ on VPN to avoid potential attacks on workstations. On May 3, Carnegie Mellon University’s CERT Coordination Center posted details about three vulnerabilities that affect the PrinterLogic Print Management Software. The vulnerabilities affect PrinterLogic versions 18.3.1.96 and older. 

According to the vulnerability report, the software does not validate SSL and software update certificates, which means attackers could take control of the software, and reconfigure the code.
This is part of vulnerability CVE-2018-5408. The vulnerability report notes the following:

“The PrinterLogic Print Management software does not validate, or incorrectly validates, the PrinterLogic management portal's SSL certificate. When a certificate is invalid or malicious, it might allow an attacker to spoof a trusted entity by using a man-in-the-middle (MITM) attack. The software might connect to a malicious host while believing it is a trusted host, or the software might be deceived into accepting spoofed data that appears to originate from a trusted host.”

Another vulnerability, CVE-2018-5409 can take over the host server.

“PrinterLogic Print Management software updates and executes the code without sufficiently verifying the origin and integrity of the code. An attacker can execute malicious code by compromising the host server, performing DNS spoofing, or modifying the code in transit.”

CVE-2019-9505 states that “PrinterLogic Print Management software does not sanitise special characters allowing for remote unauthorized changes to configuration files.”
In all cases, an attacker could remotely execute arbitrary code with system privileges.

The report recommends that users should update the PrinterLogic Print Management Software when patches are available. However, PrinterLogic has not yet released any patches. A statement from the Canadian Centre for Cyber Security indicates that a patch is currently in development.

“Consider using 'always on' VPN to prevent some of the MITM scenarios and enforce application whitelisting on the endpoint to prevent the PrinterLogic agent from executing malicious code,” the report concludes.

Forget endpoints—it’s time to secure people instead
Security used to be much simpler: employees would log in to their PC at the beginning of the working day and log off at the end. That PC wasn’t going anywhere, as it was way too heavy to lug around.
DimData: Fear finally setting in amongst vulnerable orgs
New data ranking the ‘cybermaturity’ of organisations reveals the most commonly targeted sectors are also the most prepared to deal with the ever-evolving threat landscape.
IXUP goes "post-quantum" with security tech upgrade
The secure analytics company has also partnered with Deloitte as a reseller, and launched a SaaS offering on Microsoft Azure.
NZ businesses are leaving themselves vulnerable to cyber threats
Barely six per cent of business and companies in New Zealand have adequate cyber protection.
InPhySec forges partnership to tackle NZ cybersecurity market
The Kiwi managed security services provider is partnering with CrowdStrike to bring its endpoint protection solution to its customers.
Infoblox appoints channels head for A/NZ
Kenneth Cartwright’s appointment extends Infoblox’s position in secure cloud-managed network services throughout the region.
Chch crypto exchange Cryptopia facing liquidation
It seems that Christchurch-based cryptocurrency exchange Cryptopia has been unable to recover after malicious cyber attackers stole around $20 million worth of cryptocurrency.
ExtraHop’s new partner program for enterprise security
New accreditations and partner portal enable channel partners to fast-track their expertise and build their security businesses.