Source
r/sysadmin•
Heteronymous

Vulnerability onslaught for "fun with your free time" - elevation exploit in Xerox HP and Samsung printer driver

General Discussion

https://www.bleepingcomputer.com/news/security/16-year-old-bug-in-printer-software-gives-hackers-admin-rights/

Here we go with yet another vulnerability to fill up our "free" time chasing down and remediating.

"This high severity vulnerability, which has been present in HP, Samsung, and Xerox printer software since 2005, affects hundreds of millions of devices and millions of users worldwide," according to a SentinelOne report published today and shared with BleepingComputer in advance.

The security flaw tracked as CVE-2021-3438 is a buffer overflow in the SSPORT.SYS driver for specific printer models that could lead to a local escalation of user privileges.

As the researchers discovered, the buggy driver automatically gets installed with the printer software and will be loaded by Windows after each system reboot."

HP advisory with HP and Samsung models listed:
https://support.hp.com/us-en/document/ish_3900395-3833905-16/hpsbpi03724

Xerox advisory:
https://securitydocs.business.xerox.com/wp-content/uploads/2021/05/cert_Security_Mini_Bulletin_XRX21K_for_B2XX_PH30xx_3260_3320_WC3025_32xx_33xx.pdf

Posted Jul 20, 2021, 2:47 PM UTC · edited

6218
steveinbuffalo•

we need to go with the paperless office idea.. save trees.. stop climate change.. etc

20
polypolymanJack of All Trades•

If I understand correctly, this doesn't affect UPD, even for the models listed, right? If so, glad I migrated to that this year...

9
landobJr. Sysadmin•

Thats what it looks like to me. I run a HP/Xerox shop...I'm really glad I pushed for UPD a long time ago. 98% of our printers use the UPD.

3
Nervous-Equivalent•

Sorry for the ignorance, but what is UPD? Trying to figure out if my environment needs to be patched and how to do so.

1
polypolymanJack of All Trades•

HP Universal Print Driver - basically it's HP's enterprise-grade drivers for many of their business printers.

If you installed drivers the "default" way, you probably did not end up with UPD. To be sure, check in Print Management for the driver "HP Universal Printing PCL6" or "HP Universal Printing PS".

7
Nervous-Equivalent•

Ha I should've been able to deduce that, thanks for the info. About half of our printers are using UPD and the others are model specific drivers from HP. Sounds like I have some work to do...

1
SassGoblin•

Universal Print Driver :)

https://www.support.xerox.com/en-us/product/global-printer-driver/downloads?platform=win10x64&language=en

2
crazyman50000Student•

I said about 5 years ago "I bet there's vulnerabilities in plenty of printer drivers. They're signed and can sometimes be installed by a user." And now here we are... No one really looks at or understands driver code, and yet it's well known how crappy printers can be.

7
polypolymanJack of All Trades•

The scariest part is that at one point (and I believe it's still true), you didn't have to do ANYTHING except connect to a network containing a newer HP printer, and HP Smart would install itself on your computer. This is why we have a printer VLAN now (I call it the "naughtynet").

6
dahak777•

It happens with pretty much any printer now.. there is the store app versions for ive seen canon, hp, ricoh, konica. It annoys me to no end when I connect to my customers networks

4
jackvdbuk•

How are you transiting traffic between the two vlans

2
polypolymanJack of All Trades•

In this case, the print server is on both networks, so it's the only thing that talks to the printers, the clients talk to the print server. But it just as easily could be some firewall rules on the router, to only allow incoming connections to the printer (and naturally drop the multicast traffic).

3
rockysworld•

Just saw this also. We got some HPs that are on there. Good enough to update on print server or it needs updated on all clients? Ugh

3
LightofmineKnows Enough to be Dangerous•

HOW MANY HAVE WE HAD THIS SUMMER. Keep piling it on.

3
rockysworld•

Have Phaser 3320 on that list but not seeing any system in our org that has the SSPORT.SYS driver.

1
am2o•

Tell me when there is a way to update these drivers via Intune/Endpoint.

1
HeteronymousOP•

Best route is probably via powershell. For ideas, see https://www.pdq.com/blog/how-to-add-printers-with-powershell/

1
Peace-D•

So newer Xerox models aren't affected?

1