發布編號

NCCST-ANA-2021-0000591

發布時間

Wed Dec 01 17:45:02 CST 2021

事件類型

漏洞預警

發現時間

Wed Dec 01 00:00:00 CST 2021

警訊名稱

多款HP雷射印表機、多功能事務機及掃描器存在安全漏洞(CVE-2021-39237與CVE-2021-39238)，允許遠端攻擊者執行任意程式碼，請儘速確認並進行更新

內容說明

研究人員發現多款HP雷射印表機、多功能事務機及掃描器存在安全漏洞(CVE-2021-39237與CVE-2021-39238)，攻擊者可向受影響設備傳送含有特製字型之惡意檔案，進而在字型解析過程造成緩衝區溢位(Buffer Overflow)，導致攻擊者可遠端執行任意程式碼。

影響平台

下方機型之韌體版本若為「FutureSmart3：3.9.8(不含)以前版本」、「FutureSmart4：4.11.2.1(不含)以前版本」或「FutureSmart5：5.3(不含)以前版本」，則存在漏洞：

HP Color LaserJet Enterprise CM4540 MFP series

HP Color LaserJet Enterprise Flow MFP M577

HP Color LaserJet Enterprise Flow MFP M578

HP Color LaserJet Enterprise Flow MFP M680

HP Color LaserJet Enterprise Flow MFP M681

HP Color LaserJet Enterprise Flow MFP M682

HP Color LaserJet Enterprise Flow MFP M776

HP Color LaserJet Enterprise Flow MFP M880z

HP Color LaserJet Enterprise M455

HP Color LaserJet Enterprise M552

HP Color LaserJet Enterprise M553

HP Color LaserJet Enterprise M555 Printer series

HP Color LaserJet Enterprise M651

HP Color LaserJet Enterprise M652

HP Color LaserJet Enterprise M653

HP Color LaserJet Enterprise M750

HP Color LaserJet Enterprise M751 series

HP Color LaserJet Enterprise M855 Printer series

HP Color LaserJet Enterprise M856

HP Color LaserJet Enterprise MFP M480 series

HP Color LaserJet Enterprise MFP M577

HP Color LaserJet Enterprise MFP M578

HP Color LaserJet Enterprise MFP M680

HP Color LaserJet Enterprise MFP M681

HP Color LaserJet Enterprise MFP M682

HP Color LaserJet Enterprise MFP M776

HP Color LaserJet Enterprises CP5525

HP Color LaserJet Managed E45028

HP Color LaserJet Managed E55040dw

HP Color LaserJet Managed E65050/60

HP Color LaserJet Managed E75245

HP Color LaserJet Managed E85055

HP Color LaserJet Managed Flow MFP E57540

HP Color LaserJet Managed Flow MFP E67550/60

HP Color LaserJet Managed Flow MFP E77822/25/30

HP Color LaserJet Managed Flow MFP E87640/50/60

HP Color LaserJet Managed Flow MFP M577

HP Color LaserJet Managed Flow MFP M680

HP Color LaserJet Managed Flow MFP M880zm

HP Color LaserJet Managed M553

HP Color LaserJet Managed M651

HP Color LaserJet Managed MFP E47528 series

HP Color LaserJet Managed MFP E57540

HP Color LaserJet Managed MFP E67550/60

HP Color LaserJet Managed MFP E67650/60

HP Color LaserJet Managed MFP E77422-E77428 series

HP Color LaserJet Managed MFP E77822/25/30

HP Color LaserJet Managed MFP E78223-E78228 series

HP Color LaserJet Managed MFP E78323/30

HP Color LaserJet Managed MFP E87640/50/60

HP Color LaserJet Managed MFP E87640du-E87660du series

HP Color LaserJet Managed MFP M577

HP Color LaserJet Managed MFP M680

HP Color LaserJet Managed MFP M775

HP Digital Sender Flow 8500 fn2 Document Capture Workstation

HP LaserJet Enterprise 500 color MFP M575

HP LaserJet Enterprise 500 color Printer M551 series

HP LaserJet Enterprise 500 MFP M525f

HP LaserJet Enterprise 600 Printer M601 series

HP LaserJet Enterprise 600 Printer M602 series

HP LaserJet Enterprise 600 Printer M603 series

HP LaserJet Enterprise 700 color MFP M775

HP LaserJet Enterprise 700 Printer M712 series

HP LaserJet Enterprise color Flow MFP M575

HP LaserJet Enterprise Flow MFP M525

HP LaserJet Enterprise Flow MFP M527z

HP LaserJet Enterprise Flow MFP M630

HP LaserJet Enterprise Flow MFP M631

HP LaserJet Enterprise Flow MFP M632

HP LaserJet Enterprise Flow MFP M633

HP LaserJet Enterprise Flow MFP M634

HP LaserJet Enterprise Flow MFP M635

HP LaserJet Enterprise Flow MFP M636

HP LaserJet Enterprise Flow MFP M830

HP LaserJet Enterprise M406

HP LaserJet Enterprise M407

HP LaserJet Enterprise M4555 MFP

HP LaserJet Enterprise M506

HP LaserJet Enterprise M507

HP LaserJet Enterprise M604 series

HP LaserJet Enterprise M605

HP LaserJet Enterprise M606 series

HP LaserJet Enterprise M607 series

HP LaserJet Enterprise M608 series

HP LaserJet Enterprise M609 series

HP LaserJet Enterprise M610 series

HP LaserJet Enterprise M611 series

HP LaserJet Enterprise M612 series

HP LaserJet Enterprise M806

HP LaserJet Enterprise MFP M430 series

HP LaserJet Enterprise MFP M431 series

HP LaserJet Enterprise MFP M527

HP LaserJet Enterprise MFP M528

HP LaserJet Enterprise MFP M630

HP LaserJet Enterprise MFP M631

HP LaserJet Enterprise MFP M632

HP LaserJet Enterprise MFP M633

HP LaserJet Enterprise MFP M634

HP LaserJet Enterprise MFP M635

HP LaserJet Enterprise MFP M636

HP LaserJet Enterprise MFP M725

HP LaserJet Managed 500 color MFP M575

HP LaserJet Managed 500 MFP M525

HP LaserJet Managed color Flow MFP M575

HP LaserJet Managed E40040

HP LaserJet Managed E50045

HP LaserJet Managed E50145

HP LaserJet Managed E60055/65/75 series

HP LaserJet Managed Flow MFP E52545c

HP LaserJet Managed Flow MFP E62555/65/75

HP LaserJet Managed Flow MFP E62675

HP LaserJet Managed Flow MFP E72525/30/35

HP LaserJet Managed Flow MFP E82540/50/60

HP LaserJet Managed Flow MFP M525

HP LaserJet Managed Flow MFP M527z

HP LaserJet Managed Flow MFP M630

HP LaserJet Managed Flow MFP M830

HP LaserJet Managed M506

HP LaserJet Managed M605 series

HP LaserJet Managed MFP E42540 series

HP LaserJet Managed MFP E52545

HP LaserJet Managed MFP E52645

HP LaserJet Managed MFP E62555/65

HP LaserJet Managed MFP E62655/65

HP LaserJet Managed MFP E72425/30

HP LaserJet Managed MFP E72525/30/35

HP LaserJet Managed MFP E82540/50/60

HP LaserJet Managed MFP E82540/50/60du series

HP LaserJet Managed MFP M527

HP LaserJet Managed MFP M630

HP LaserJet Managed MFP M725

HP OfficeJet Enterprise Color MFP X585

HP OfficeJet Enterprise Color X555

HP OfficeJet Managed Color MFP X585

HP PageWide Color 755

HP PageWide Color MFP 774

HP PageWide Color MFP 779

HP PageWide Enterprise Color 556

HP PageWide Enterprise Color 765

HP PageWide Enterprise Color Flow MFP 586z

HP PageWide Enterprise Color Flow MFP 780f

HP PageWide Enterprise Color Flow MFP 785

HP PageWide Enterprise Color MFP 586

HP PageWide Enterprise Color MFP 780

HP PageWide Managed Color E55650

HP PageWide Managed Color E75160

HP PageWide Managed Color Flow MFP E58650z

HP PageWide Managed Color Flow MFP E77650/60z

HP PageWide Managed Color Flow MFP E77660z

HP PageWide Managed Color MFP E58650dn

HP PageWide Managed Color MFP E77650

HP PageWide Managed Color MFP P77440

HP PageWide Managed Color MFP P77940/50/60

HP PageWide Managed Color P75250

HP PageWide Managed P55250dw Printer series

HP PageWide Managed P57750dw Multifunction Printer

HP Scanjet Enterprise 8500 FN1 Document Capture Workstation series

HP ScanJet Enterprise Flow N9120 fn2 Document Scanner

下方機型之韌體版本若為2142A(不含)以前版本，則存在漏洞：

HP PageWide 352dw Printer

HP PageWide 377dw Multifunction Printer

HP PageWide Pro 452dn Printer series

HP PageWide Pro 452dw Printer series

HP PageWide Pro 477dn Multifunction Printer series

HP PageWide Pro 477dw Multifunction Printer series

HP PageWide Pro 552dw Printer series

HP PageWide Pro 577 Multifunction Printer series

下方機型之韌體版本若為20211109(不含)以前版本，則存在漏洞：

HP Color LaserJet Pro M154

HP Color LaserJet Pro M253, M254

HP Color LaserJet Pro MFP M180, M181

HP Color LaserJet Pro MFP M280, M281

影響等級

高

建議措施

HP官方已針對這些漏洞釋出更新程式，請各機關聯絡設備維護廠商或參考以下網址進行更新：

1.https://support.hp.com/us-en/document/ish_5000383-5000409-16

2.https://support.hp.com/us-en/document/ish_5000124-5000148-16

參考資料

1. https://support.hp.com/us-en/document/ish_5000383-5000409-16

2. https://support.hp.com/us-en/document/ish_5000124-5000148-16

3. https://thehackernews.com/2021/11/critical-wormable-security-flaw-found.html