HP warns LaserJet owners to patch their printers

 

Gallery

Posted on 9 Feb 2009 at 10:49

HP has warned that owners of its LaserJet printers run the risk of having their previously printed documents read by hackers, unless they apply the new firmware.

The company says the vulnerability can be exploited remotely to "read arbitrary system configuration files and cached documents" stored on the printer through its web administration console.

According to the advisory, ten different models of LaserJet, Color LaserJet and Digital Sender models are affected.

Analysts have warned companies not to take the issue lightly, and to apply the firmware update at the first possible chance.

"Printers tend to be low on the priority list of systems or devices to be patched, this one will likely linger for years to come," says Adrien de Beaupre, an analyst with the SANS Institute's Internet Storm Center.

"The impact might not seem severe, as in the attacker can view the printer configuration, however viewing cached versions of printed documents can be. Other than patching, disallowing access to the web admin interface is likely the only other mitigation."

Author: Stuart Turton