Detections
Analytics

Lexmark Printer config.html Administrator Authentication Bypass (FREAK)

medium Nessus Plugin ID 86426

Language:

Synopsis

The remote printer is affected by a security bypass vulnerability known as FREAK.

Description

According to its firmware version, the remote Lexmark printer is affected by a security feature bypass vulnerability, known as FREAK (Factoring attack on RSA-EXPORT Keys), due to the support of weak EXPORT_RSA cipher suites with keys less than or equal to 512 bits. A man-in-the-middle attacker may be able to downgrade the SSL/TLS connection to use EXPORT_RSA cipher suites which can be factored in a short amount of time, allowing the attacker to intercept and decrypt the traffic.

Solution

Upgrade to a fixed release as referenced in the vendor advisory.

See Also

http://www.nessus.org/u?60f299d0

https://www.smacktls.com/#freak

Plugin Details

Severity: Medium

ID: 86426

File Name: lexmark_printer_TE701.nasl

Version: 1.3

Type: remote

Family: Misc.

Published: 10/19/2015

Updated: 7/12/2018

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 4.4

CVSS v2

Risk Factor: Medium

Base Score: 4.3

Temporal Score: 3.2

Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N

Vulnerability Information

CPE: cpe:/h:lexmark:cs31x, cpe:/h:lexmark:cs41x, cpe:/h:lexmark:cs51x, cpe:/h:lexmark:cx310, cpe:/h:lexmark:cx410, cpe:/h:lexmark:cx510, cpe:/h:lexmark:xc2132, cpe:/h:lexmark:ms310, cpe:/h:lexmark:ms312, cpe:/h:lexmark:ms315, cpe:/h:lexmark:ms410, cpe:/h:lexmark:ms415, cpe:/h:lexmark:ms51x, cpe:/h:lexmark:ms610dn, cpe:/h:lexmark:ms610dtn, cpe:/h:lexmark:m1145, cpe:/h:lexmark:m3150dn, cpe:/h:lexmark:ms610de, cpe:/h:lexmark:ms610dte, cpe:/h:lexmark:m3150, cpe:/h:lexmark:ms71x, cpe:/h:lexmark:ms810n, cpe:/h:lexmark:ms810dn, cpe:/h:lexmark:ms810dtn, cpe:/h:lexmark:ms811, cpe:/h:lexmark:ms812dn, cpe:/h:lexmark:ms812dtn, cpe:/h:lexmark:m5163dn, cpe:/h:lexmark:ms810de, cpe:/h:lexmark:m5155, cpe:/h:lexmark:m5163, cpe:/h:lexmark:ms812de, cpe:/h:lexmark:m5170, cpe:/h:lexmark:ms91x, cpe:/h:lexmark:mx310, cpe:/h:lexmark:mx410, cpe:/h:lexmark:mx510, cpe:/h:lexmark:mx511, cpe:/h:lexmark:xm1145, cpe:/h:lexmark:mx610, cpe:/h:lexmark:mx611, cpe:/h:lexmark:xm3150, cpe:/h:lexmark:mx71x, cpe:/h:lexmark:mx81x, cpe:/h:lexmark:xm51xx, cpe:/h:lexmark:xm71xx, cpe:/h:lexmark:mx91x, cpe:/h:lexmark:mx6500e, cpe:/h:lexmark:c746, cpe:/h:lexmark:c748, cpe:/h:lexmark:cs748, cpe:/h:lexmark:c79x, cpe:/h:lexmark:cs796, cpe:/h:lexmark:c925, cpe:/h:lexmark:c95x, cpe:/h:lexmark:x548, cpe:/h:lexmark:xs548, cpe:/h:lexmark:x74x, cpe:/h:lexmark:xs748, cpe:/h:lexmark:x792, cpe:/h:lexmark:xs79x, cpe:/h:lexmark:x925, cpe:/h:lexmark:xs925, cpe:/h:lexmark:x95x, cpe:/h:lexmark:xs95x, cpe:/h:lexmark:6500e, cpe:/h:lexmark:c734, cpe:/h:lexmark:c736, cpe:/h:lexmark:e46x, cpe:/h:lexmark:t650, cpe:/h:lexmark:t652, cpe:/h:lexmark:t654, cpe:/h:lexmark:t656, cpe:/h:lexmark:w85x, cpe:/h:lexmark:x46x, cpe:/h:lexmark:x65x, cpe:/h:lexmark:x73x, cpe:/h:lexmark:x86x, cpe:/h:lexmark:c54x, cpe:/h:lexmark:e26x, cpe:/h:lexmark:e36x, cpe:/h:lexmark:x26x, cpe:/h:lexmark:x36x, cpe:/h:lexmark:x54x, cpe:/h:lexmark:c52x, cpe:/h:lexmark:c53x, cpe:/h:lexmark:c77x, cpe:/h:lexmark:c78x, cpe:/h:lexmark:c92x, cpe:/h:lexmark:c93x, cpe:/h:lexmark:e45x, cpe:/h:lexmark:t64x, cpe:/h:lexmark:w84x, cpe:/h:lexmark:x642, cpe:/h:lexmark:x644, cpe:/h:lexmark:x646, cpe:/h:lexmark:x64xef, cpe:/h:lexmark:x77x, cpe:/h:lexmark:x78x, cpe:/h:lexmark:x85x, cpe:/h:lexmark:x94x, cpe:/h:lexmark:n4000, cpe:/h:lexmark:n4050e, cpe:/h:lexmark:n7xxe

Required KB Items: www/lexmark_printer/model, www/lexmark_printer/base_ver

Exploit Ease: No known exploits are available

Patch Publication Date: 4/20/2015

Vulnerability Publication Date: 1/6/2015

Reference Information

CVE: CVE-2015-0204, CVE-2015-1637

BID: 71936, 72965

CERT: 243585