Older Canon Pixma TR150 Driver Vulnerable to Privilege Escalation

guest · Aug 13, 2021

Older Canon Pixma TR150 Driver Vulnerable to Privilege Escalation
August 12, 2021
https://www.technadu.com/older-canon-pixma-tr150-driver-vulnerable-to-privilege-escalation/294544/

Canon Pixma TR150 could lead to your computer getting pwned depending on which driver you’re using.

A researcher has found a way to carry out a time-sensitive attack that involves replacing a DLL to achieve privilege escalation.

There’s a fixing patch available from Canon, so using the latest driver when adding the printer is imperative.

Click to expand...

The Canon Pixma TR150 compact printer could enable a local attacker to run code on the target system as admin, due to a nasty vulnerability (CVE-2021-38085) existing in the printer’s driver versions 3.71.2.10 and older. The privilege escalation opportunity opens up during the “add printer” step, during which a local attacker could overwrite the “CNMurGE.dll” into the CanonBJ %PROGRAMDATA% location, and then run code as NT AUTHORITY\SYSTEM – which is a case of escalation of privilege.

There’s already a Metasploit example for the above, released by researcher Jacob Baines, who provides the details of this on GitHub.
The researcher also presented a patch from a low-privileged Windows user to SYSTEM during the recent DEF CON, so if you’re interested in the full details of the exploit you can watch the following video.
Click to expand...

Obviously, the researcher has shared his findings with Canon prior to the publication of all that, so the Japanese company had the time to release a fixing patch in the meantime.

This is an example of why printers shouldn’t come with drivers on CDs, as these are vulnerable to exploitation.
Click to expand...

Log in or Sign up

Older Canon Pixma TR150 Driver Vulnerable to Privilege Escalation

guest Guest

Log in or Sign up

Older Canon Pixma TR150 Driver Vulnerable to Privilege Escalation

guest Guest

Useful Searches