{"vuid":"VU#568073","idnumber":"568073","name":"Canon digital multifunction copiers FTP bounce vulnerability","keywords":["Canon","digital multifunction copiers","FTP bounce"],"overview":"Some models of Canon digital multifunction copiers are vulnerable to the FTP bounce attack.","clean_desc":"From the Problems With The FTP PORT Command document: The FTP Bounce Attack To conform with the FTP protocol, the PORT command has the originating machine specify an arbitrary destination machine and port for the data connection. However, this behavior also means that an attacker can open a connection to a port of the attacker's choosing on a machine that may not be the originating client. Some Canon digital multifunction printers contain an FTP server that is vulnerable to the FTP bounce attack.","impact":"A remote, unauthenticated attacker may be able to conduct port scans or send arbitrary (TCP) traffic to other hosts.","resolution":"We are currently unaware of a practical solution to this problem.","workarounds":"The following workarounds may mitigate this vulnerability: Disable the affected FTP server\nAdministrators and users should either turn off the vulnerable FTP server or disable anonymous access. For more information, see the \"Steps to take to clear vulnerability\" section of the Canon Web Advisory: Digital multifunction printer vulnerability. Use host-based firewalls\nAdministrators and users can use host-based firewalls to prevent affected printers and other devices from creating connections to arbitrary TCP ports.","sysaffected":"","thanks":"Thanks to Canon for information that was used in this report. Canon credits Nate Johnson and the Indiana University for reporting this vulnerability.","author":"This document was written by Ryan Giobbi.","public":["http://www.usa.canon.com/html/security/pdf/CVA-001.pdf","http://www.canon-europe.com/For_work/Canon_Europe_CBS_Web_Advisory_Digital_Multifunction_Printers.asp","http://www.cert.org/tech_tips/ftp_port_attacks.html#3.2","http://nmap.org/hobbit.ftpbounce.txt"],"cveids":["CVE-2008-0303"],"certadvisory":"","uscerttechnicalalert":null,"datecreated":"2008-02-13T15:30:56Z","publicdate":"2008-02-28T00:00:00Z","datefirstpublished":"2008-02-28T19:46:21Z","dateupdated":"2008-04-29T16:08:04Z","revision":12,"vrda_d1_directreport":"1","vrda_d1_population":"3","vrda_d1_impact":"2","cam_widelyknown":"20","cam_exploitation":"0","cam_internetinfrastructure":"4","cam_population":"1","cam_impact":"4","cam_easeofexploitation":"20","cam_attackeraccessrequired":"20","cam_scorecurrent":"0.72","cam_scorecurrentwidelyknown":"0.72","cam_scorecurrentwidelyknownexploited":"1.32","ipprotocol":"tcp","cvss_accessvector":"","cvss_accesscomplexity":"","cvss_authentication":null,"cvss_confidentialityimpact":"","cvss_integrityimpact":"","cvss_availabilityimpact":"","cvss_exploitablity":null,"cvss_remediationlevel":"","cvss_reportconfidence":"","cvss_collateraldamagepotential":"","cvss_targetdistribution":"","cvss_securityrequirementscr":"","cvss_securityrequirementsir":"","cvss_securityrequirementsar":"","cvss_basescore":"","cvss_basevector":"","cvss_temporalscore":"","cvss_environmentalscore":"","cvss_environmentalvector":"","metric":0.72,"vulnote":null}