sb-as logo
Story image

PrinterLogic software vulnerable to remote attacks

09 May 2019

Businesses that use PrinterLogic Print Management Software should look at using an ‘always’ on VPN to avoid potential attacks on workstations. On May 3, Carnegie Mellon University’s CERT Coordination Center posted details about three vulnerabilities that affect the PrinterLogic Print Management Software. The vulnerabilities affect PrinterLogic versions 18.3.1.96 and older. 

According to the vulnerability report, the software does not validate SSL and software update certificates, which means attackers could take control of the software, and reconfigure the code.
This is part of vulnerability CVE-2018-5408. The vulnerability report notes the following:

“The PrinterLogic Print Management software does not validate, or incorrectly validates, the PrinterLogic management portal's SSL certificate. When a certificate is invalid or malicious, it might allow an attacker to spoof a trusted entity by using a man-in-the-middle (MITM) attack. The software might connect to a malicious host while believing it is a trusted host, or the software might be deceived into accepting spoofed data that appears to originate from a trusted host.”

Another vulnerability, CVE-2018-5409 can take over the host server.

“PrinterLogic Print Management software updates and executes the code without sufficiently verifying the origin and integrity of the code. An attacker can execute malicious code by compromising the host server, performing DNS spoofing, or modifying the code in transit.”

CVE-2019-9505 states that “PrinterLogic Print Management software does not sanitise special characters allowing for remote unauthorized changes to configuration files.”
In all cases, an attacker could remotely execute arbitrary code with system privileges.

The report recommends that users should update the PrinterLogic Print Management Software when patches are available. However, PrinterLogic has not yet released any patches. A statement from the Canadian Centre for Cyber Security indicates that a patch is currently in development.

“Consider using 'always on' VPN to prevent some of the MITM scenarios and enforce application whitelisting on the endpoint to prevent the PrinterLogic agent from executing malicious code,” the report concludes.

Download image
451 Research: The new shape of the enterprise network
In this new world, distance has become the silent digital business killer. Latency looms large, especially for high-performance edge applications, IoT and 5G use cases. More
Story image
Adobe, IBM and Red Hat partner up to accelerate DX and real-time data security
"As companies undergo their digital transformations and move core workloads to the cloud, the entire C-suite is facing a re-framing of their roles to meet customer demands – all while keeping security front and centre."More
Story image
Almost 10,000 unsecured databases with more than 10 billion credentials exposed
Research has identified a total of 9,517 unsecured databases containing 10,463,315,645 entries with such data as emails, passwords, and phone numbers.More
Story image
Increased demand for cloud computing as organisations look to achieve business continuity - Aruba
The increase in remote working has also created a focus on cyber security for all businesses.More
Download image
Why there's a huge push for NFV in today's enterprises
To help networking and IT professionals better understand the opportunities and challenges associated with deploying NFV technology, new research based on responses from more than 1,300 IT and networking professionals from around the world is now available. More
Story image
CrowdStrike uncovers key cybersecurity findings following COVID-19
Businesses around the world see cybersecurity as a top investment following a mass move to remote working, and it is expected that technology budgets will rise despite uncertain economic times.More