Lexmark Printers Open to Arbitrary Code-Execution Zero-Day

guest · Jun 22, 2021

Lexmark Printers Open to Arbitrary Code-Execution Zero-Day
June 22, 2021
https://threatpost.com/lexmark-printers-code-execution-zero-day/167111/

Lexmark printers – those ubiquitous, inky office workhorses that fill homes and offices, and are found all the way on up to the federal government – have an unpatched vulnerability that could lead to serious, easy-to-execute attacks that require neither privileges nor user interaction and which can lead to arbitrary code execution.

According to an advisory filed by researcher Julio Aviña on the IBM X-Force Exchange, the flaw could lead to a low-complexity attack that could allow a local attacker to execute arbitrary code. The vulnerability’s CVSS 3.0 base score is high, at 8.4. Fortunately, it doesn’t appear to have been exploited yet: The report lists the bug’s exploitability as “unproven.”
Click to expand...

The bug, found in the Lexmark Printer Software G2 Installation Package, is caused by an unquoted service-path vulnerability in the “LM__bdsvc” service. That package allows an administrator to customize the users’ installation experience, according to Lexmark.

As of Tuesday, there was no patch or other workaround available, Aviña wrote: “No remedy available as of June 21, 2021.”

The advisory states that a successful attempt to exploit the bug requires the attacker “to insert an executable file into the service path undetected by the OS or some security application.” When the service or the system restarts, that executable will run with elevated privileges.
Click to expand...

Lexmark told Threatpost on Tuesday that a fix is in the works. Lexmark CSO Bryan Willett said in an emailed statement that “Lexmark takes security very seriously. We are aware of this concern and are working to address the vulnerability. We welcome security researchers to report vulnerabilities directly at Lexmark Security Advisories.”
Click to expand...

Log in or Sign up

Lexmark Printers Open to Arbitrary Code-Execution Zero-Day

guest Guest

Log in or Sign up

Lexmark Printers Open to Arbitrary Code-Execution Zero-Day

guest Guest

Useful Searches