Issues the date: 2008-08-26
Renewal date: 2008-08-27

Is affected the system:
Kyocera Mita Scanner File Utility 3.3.0.1
Description:
--------------------------------------------------------------------------------
BUGTRAQ ID: 30855

Kyocera Mita Scanner File Utility uses in the graph which scans the scanner preserving PC.

Scanner File in the Utility service has many cracks, causes to system's invasion.

First, the service lacks the authentication, therefore anybody may to the goal machine upload document; Next, in the document may contain any content, including binary data; Finally, the filename is possibly changed contains the table of contents information, the document from the default upload position again direction detection to the position which assigns. The union uses the above crack, Scanner File the Utility service permission long-distance aggressor's to system on optional position upload random document. If did not know that in the client side account number correct ID number, may use getidno which inlays the order sweeping system examination all ID number, as well as the printer upload document needs all related passwords.

<* origin: Seth Fogie (contact@airscanner.com)
 
  Link: http://www.informit.com/guides/printerfriendly.aspx?g=security&seqNum=320
        http://www.informit.com/guides/printerfriendly.aspx?g=security&seqNum=321
*>

Test method:
--------------------------------------------------------------------------------

Warning

The following procedure (method) possibly has the aggressivity, only supplies the safe research and teaching. The user risk is proud!

http://www.whitewolfsecurity.com/security/metasploit/fileutility.txt

Suggested:
--------------------------------------------------------------------------------
Manufacturer patch:

Kyocera Mita
------------
At present the manufacturer has not provided the patch or the promotion procedure, we suggested that uses this software's user momentarily to pay attention to the manufacturer the main page to gain the newest edition:

http://usa.kyoceramita.com/KMAGlobalpub/jsp/Kyocera/home.jsp