Vulnerability-Lookup

CNVD-2017-38281

Vulnerability from cnvd - Published: 2017-12-27

Title

多款HP产品远程代码执行漏洞

Description

HP Color LaserJet Enterprise M651 CZ255A等都是美国惠普（HP）公司的打印机设备。多款HP产品中存在远程代码执行漏洞。远程攻击者可利用该漏洞在受影响应用程序的上下文中执行任意代码。

Severity

高

Patch Name

多款HP产品远程代码执行漏洞的补丁

Patch Description

HP Color LaserJet Enterprise M651 CZ255A等都是美国惠普（HP）公司的打印机设备。多款HP产品中存在远程代码执行漏洞。远程攻击者可利用该漏洞在受影响应用程序的上下文中执行任意代码。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description

目前厂商已发布升级补丁以修复漏洞，补丁获取链接： https://support.hp.com/nz-en/document/c05839270

Reference

http://www.securityfocus.com/bid/101965

Impacted products

Name
['HP Color LaserJet Managed E65050 L3U55A', 'HP Color LaserJet Managed E65060 L3U56A', 'HP Color LaserJet Managed E65060 L3U57A', 'HP Color LaserJet Enterprise M651 CZ255A', 'HP Color LaserJet Enterprise M651 CZ256A', 'HP Color LaserJet Enterprise M651 CZ257A', 'HP Color LaserJet Enterprise M651 CZ258A', 'HP Color LaserJet Enterprise M652 J7Z98A', 'HP Color LaserJet Enterprise M652 J7Z99A', 'HP Color LaserJet Enterprise M653 J8A04A', 'HP Color LaserJet Enterprise M653 J8A05A', 'HP Color LaserJet Enterprise M653 J8A06A', 'HP Color LaserJet Enterprise MFP M577 B5L46A', 'HP Color LaserJet Enterprise MFP M577 B5L47A', 'HP Color LaserJet Enterprise MFP M577 B5L48A', 'HP Color LaserJet Enterprise M552 B5L23A', 'HP Color LaserJet Enterprise M552 B5L23V', 'HP Color LaserJet Enterprise M553 B5L24A', 'HP Color LaserJet Enterprise M553 B5L', 'HP Color LaserJet M680 CZ250A', 'HP Color LaserJet M680 CA251A', 'HP LaserJet Enterprise 500 color MFP M575 CD644A', 'HP LaserJet Enterprise 500 color MFP M575 CD645A', 'HP LaserJet Enterprise 500 MFP M525 CF116A', 'HP LaserJet Enterprise 500 MFP M525 CF117A', 'HP LaserJet Enterprise 700 color MFP M775']

Name

['HP Color LaserJet Managed E65050 L3U55A', 'HP Color LaserJet Managed E65060 L3U56A', 'HP Color LaserJet Managed E65060 L3U57A', 'HP Color LaserJet Enterprise M651 CZ255A', 'HP Color LaserJet Enterprise M651 CZ256A', 'HP Color LaserJet Enterprise M651 CZ257A', 'HP Color LaserJet Enterprise M651 CZ258A', 'HP Color LaserJet Enterprise M652 J7Z98A', 'HP Color LaserJet Enterprise M652 J7Z99A', 'HP Color LaserJet Enterprise M653 J8A04A', 'HP Color LaserJet Enterprise M653 J8A05A', 'HP Color LaserJet Enterprise M653 J8A06A', 'HP Color LaserJet Enterprise MFP M577 B5L46A', 'HP Color LaserJet Enterprise MFP M577 B5L47A', 'HP Color LaserJet Enterprise MFP M577 B5L48A', 'HP Color LaserJet Enterprise M552 B5L23A', 'HP Color LaserJet Enterprise M552 B5L23V', 'HP Color LaserJet Enterprise M553 B5L24A', 'HP Color LaserJet Enterprise M553 B5L', 'HP Color LaserJet M680 CZ250A', 'HP Color LaserJet M680 CA251A', 'HP LaserJet Enterprise 500 color MFP M575 CD644A', 'HP LaserJet Enterprise 500 color MFP M575 CD645A', 'HP LaserJet Enterprise 500 MFP M525 CF116A', 'HP LaserJet Enterprise 500 MFP M525 CF117A', 'HP LaserJet Enterprise 700 color MFP M775']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2017-2750"
    }
  },
  "description": "HP Color LaserJet Enterprise M651 CZ255A\u7b49\u90fd\u662f\u7f8e\u56fd\u60e0\u666e\uff08HP\uff09\u516c\u53f8\u7684\u6253\u5370\u673a\u8bbe\u5907\u3002\r\n\r\n\u591a\u6b3eHP\u4ea7\u54c1\u4e2d\u5b58\u5728\u8fdc\u7a0b\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e\u3002\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5728\u53d7\u5f71\u54cd\u5e94\u7528\u7a0b\u5e8f\u7684\u4e0a\u4e0b\u6587\u4e2d\u6267\u884c\u4efb\u610f\u4ee3\u7801\u3002",
  "discovererName": "Stephen Breen",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u53d1\u5e03\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6f0f\u6d1e\uff0c\u8865\u4e01\u83b7\u53d6\u94fe\u63a5\uff1a\r\nhttps://support.hp.com/nz-en/document/c05839270",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2017-38281",
  "openTime": "2017-12-27",
  "patchDescription": "HP Color LaserJet Enterprise M651 CZ255A\u7b49\u90fd\u662f\u7f8e\u56fd\u60e0\u666e\uff08HP\uff09\u516c\u53f8\u7684\u6253\u5370\u673a\u8bbe\u5907\u3002\r\n\r\n\u591a\u6b3eHP\u4ea7\u54c1\u4e2d\u5b58\u5728\u8fdc\u7a0b\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e\u3002\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5728\u53d7\u5f71\u54cd\u5e94\u7528\u7a0b\u5e8f\u7684\u4e0a\u4e0b\u6587\u4e2d\u6267\u884c\u4efb\u610f\u4ee3\u7801\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "\u591a\u6b3eHP\u4ea7\u54c1\u8fdc\u7a0b\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "HP Color LaserJet Managed E65050 L3U55A",
      "HP Color LaserJet Managed E65060 L3U56A",
      "HP Color LaserJet Managed E65060 L3U57A",
      "HP Color LaserJet Enterprise M651 CZ255A",
      "HP Color LaserJet Enterprise M651 CZ256A",
      "HP Color LaserJet Enterprise M651 CZ257A",
      "HP Color LaserJet Enterprise M651 CZ258A",
      "HP Color LaserJet Enterprise M652 J7Z98A",
      "HP Color LaserJet Enterprise M652 J7Z99A",
      "HP Color LaserJet Enterprise M653 J8A04A",
      "HP Color LaserJet Enterprise M653 J8A05A",
      "HP Color LaserJet Enterprise M653 J8A06A",
      "HP Color LaserJet Enterprise MFP M577 B5L46A",
      "HP Color LaserJet Enterprise MFP M577 B5L47A",
      "HP Color LaserJet Enterprise MFP M577 B5L48A",
      "HP Color LaserJet Enterprise M552 B5L23A",
      "HP Color LaserJet Enterprise M552 B5L23V",
      "HP Color LaserJet Enterprise M553 B5L24A",
      "HP Color LaserJet Enterprise M553 B5L",
      "HP Color LaserJet M680 CZ250A",
      "HP Color LaserJet M680 CA251A",
      "HP LaserJet Enterprise 500 color MFP M575 CD644A",
      "HP LaserJet Enterprise 500 color MFP M575 CD645A",
      "HP LaserJet Enterprise 500 MFP M525 CF116A",
      "HP LaserJet Enterprise 500 MFP M525 CF117A",
      "HP LaserJet Enterprise 700 color MFP M775"
    ]
  },
  "referenceLink": "http://www.securityfocus.com/bid/101965",
  "serverity": "\u9ad8",
  "submitTime": "2017-11-27",
  "title": "\u591a\u6b3eHP\u4ea7\u54c1\u8fdc\u7a0b\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e"
}

CVE-2017-2750 (GCVE-0-2017-2750)

Vulnerability from cvelistv5 – Published: 2018-01-23 16:00 – Updated: 2024-09-16 19:05

Summary

Insufficient Solution DLL Signature Validation allows potential execution of arbitrary code in HP LaserJet Enterprise printers, HP PageWide Enterprise printers, HP LaserJet Managed printers, HP OfficeJet Enterprise printers before 2308937_578479, 2405087_018548, and other firmware versions.

Severity ?

No CVSS data available.

CWE

Execution of arbitrary code

Assigner

References

URL

Tags

	https://support.hp.com/us-en/document/c05839270	vendor-advisoryx_refsource_HP
	http://www.securityfocus.com/bid/101965	vdb-entryx_refsource_BID

Impacted products

	Vendor	Product	Version
	HP Inc.	HP LaserJet Enterprise printers, HP PageWide Enterprise printers, HP LaserJet Managed printers, HP OfficeJet Enterprise printers	Affected: 2308937_578479, 2405087_018548, and other firmware versions.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T14:02:07.641Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "HPSBPI03569",
            "tags": [
              "vendor-advisory",
              "x_refsource_HP",
              "x_transferred"
            ],
            "url": "https://support.hp.com/us-en/document/c05839270"
          },
          {
            "name": "101965",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/101965"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "HP LaserJet Enterprise printers, HP PageWide Enterprise printers, HP LaserJet Managed printers, HP OfficeJet Enterprise printers",
          "vendor": "HP Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "2308937_578479, 2405087_018548, and other firmware versions."
            }
          ]
        }
      ],
      "datePublic": "2017-01-17T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Insufficient Solution DLL Signature Validation allows potential execution of arbitrary code in HP LaserJet Enterprise printers, HP PageWide Enterprise printers, HP LaserJet Managed printers, HP OfficeJet Enterprise printers before 2308937_578479, 2405087_018548, and other firmware versions."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Execution of arbitrary code",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-01-24T10:57:01",
        "orgId": "74586083-13ce-40fd-b46a-8e5d23cfbcb2",
        "shortName": "hp"
      },
      "references": [
        {
          "name": "HPSBPI03569",
          "tags": [
            "vendor-advisory",
            "x_refsource_HP"
          ],
          "url": "https://support.hp.com/us-en/document/c05839270"
        },
        {
          "name": "101965",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/101965"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "hp-security-alert@hp.com",
          "DATE_PUBLIC": "2017-01-17T00:00:00",
          "ID": "CVE-2017-2750",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "HP LaserJet Enterprise printers, HP PageWide Enterprise printers, HP LaserJet Managed printers, HP OfficeJet Enterprise printers",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "2308937_578479, 2405087_018548, and other firmware versions."
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "HP Inc."
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Insufficient Solution DLL Signature Validation allows potential execution of arbitrary code in HP LaserJet Enterprise printers, HP PageWide Enterprise printers, HP LaserJet Managed printers, HP OfficeJet Enterprise printers before 2308937_578479, 2405087_018548, and other firmware versions."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Execution of arbitrary code"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "HPSBPI03569",
              "refsource": "HP",
              "url": "https://support.hp.com/us-en/document/c05839270"
            },
            {
              "name": "101965",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/101965"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "74586083-13ce-40fd-b46a-8e5d23cfbcb2",
    "assignerShortName": "hp",
    "cveId": "CVE-2017-2750",
    "datePublished": "2018-01-23T16:00:00Z",
    "dateReserved": "2016-12-01T00:00:00",
    "dateUpdated": "2024-09-16T19:05:28.870Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CNVD-2017-38281

CVE-2017-2750 (GCVE-0-2017-2750)

Tags

Sightings

Nomenclature