sb-au logo
Story image

PrinterLogic software vulnerable to remote attacks

09 May 2019

Businesses that use PrinterLogic Print Management Software should look at using an ‘always’ on VPN to avoid potential attacks on workstations. On May 3, Carnegie Mellon University’s CERT Coordination Center posted details about three vulnerabilities that affect the PrinterLogic Print Management Software. The vulnerabilities affect PrinterLogic versions 18.3.1.96 and older. 

According to the vulnerability report, the software does not validate SSL and software update certificates, which means attackers could take control of the software, and reconfigure the code.
This is part of vulnerability CVE-2018-5408. The vulnerability report notes the following:

“The PrinterLogic Print Management software does not validate, or incorrectly validates, the PrinterLogic management portal's SSL certificate. When a certificate is invalid or malicious, it might allow an attacker to spoof a trusted entity by using a man-in-the-middle (MITM) attack. The software might connect to a malicious host while believing it is a trusted host, or the software might be deceived into accepting spoofed data that appears to originate from a trusted host.”

Another vulnerability, CVE-2018-5409 can take over the host server.

“PrinterLogic Print Management software updates and executes the code without sufficiently verifying the origin and integrity of the code. An attacker can execute malicious code by compromising the host server, performing DNS spoofing, or modifying the code in transit.”

CVE-2019-9505 states that “PrinterLogic Print Management software does not sanitise special characters allowing for remote unauthorized changes to configuration files.”
In all cases, an attacker could remotely execute arbitrary code with system privileges.

The report recommends that users should update the PrinterLogic Print Management Software when patches are available. However, PrinterLogic has not yet released any patches. A statement from the Canadian Centre for Cyber Security indicates that a patch is currently in development.

“Consider using 'always on' VPN to prevent some of the MITM scenarios and enforce application whitelisting on the endpoint to prevent the PrinterLogic agent from executing malicious code,” the report concludes.

Story image
Airlock Digital seeks to empower Aussie SMEs with AustCyber funding
“With more SMEs and other organisations looking to adopt application whitelisting as a primary cyber defence mechanism, we plan to significantly expand Airlock Digital's partner network."More
Story image
Interview: Checkmarx on the state of software security in Asia Pacific
"While the benefits of software are obvious, this proliferation also creates a massive and ever-evolving attack surface,” says Checkmarx A/NZ country manager Raygan Flores.More
Story image
Investment in Digital Trust crucial for Australian economy, study finds
Digital Trust is playing an increasingly important role in the Australian economy, both in terms of enabling more investment and jobs, and reducing the risk of disruption to businesses around the country. More
Story image
Check Point catches new form of Joker malware targeting Google Play Store
Check Point researchers have identified malware that is disguised as a legitimate looking Android application and is used to capture user’s information. Known as ‘Joker’, the billing fraud malware is specifically designed to evade Google Play Store protections.More
Story image
Prevasio unveils threat analysis sandbox for containers
New SaaS solution aims to prevent breaches by automating dynamic threat analysis for docker containers.More
Story image
APAC parents hide internet activity from children more than cyber attackers
A new report from Kaspersky has turned a modern trope - that teens have things to hide in their internet history - on its head, by proving the opposite is also true.More