Home / vulnerabilities HP Security Bulletin HPSBPI03360 2
Posted on 30 June 2015
Source : packetstormsecurity.org Link
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Note: the current version of the following document is available here:
https://h20564.www2.hp.com/portal/site/hpsc/public/kb/
docDisplay?docId=emr_na-c04720842
SUPPORT COMMUNICATION - SECURITY BULLETIN
Document ID: c04720842
Version: 2
HPSBPI03360 rev.2 - HP LaserJet Printers and MFPs, HP OfficeJet Printers and
MFPs, and HP JetDirect Networking cards using OpenSSL, Remote Disclosure of
Information
NOTICE: The information in this Security Bulletin should be acted upon as
soon as possible.
Release Date: 2015-06-26
Last Updated: 2015-06-26
Potential Security Impact: Remote disclosure of information
Source: Hewlett-Packard Company, HP Software Security Response Team
VULNERABILITY SUMMARY
A potential security vulnerability has been identified with certain HP
LaserJet Printers and MFPs, certain HP OfficeJet Printers and MFPs, and
certain HP JetDirect Networking cards using OpenSSL. This is the SSLv3
vulnerability known as "Padding Oracle on Downgraded Legacy Encryption" or
"POODLE", which could be exploited remotely to allow disclosure of
information.
References:
CVE-2014-3566 (SSRT101114)
SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed.
Please refer to the RESOLUTION
below for a list of impacted products.
Note: all product versions are impacted prior to the fixed versions listed.
BACKGROUND
CVSS 2.0 Base Metrics
===========================================================
Reference Base Vector Base Score
CVE-2014-3566 (AV:N/AC:M/Au:N/C:P/I:N/A:N) 4.3
===========================================================
Information on CVSS is documented
in HP Customer Notice: HPSN-2008-002
RESOLUTION
HP has provided firmware updates for impacted printers as in the table below.
To obtain the updated firmware, go to www.hp.com and follow these steps:
Select "Drivers & Software".
Enter the appropriate product name listed in the table below into the search
field.
Click on "Search".
Click on the appropriate product.
Under "Select operating system" click on "Cross operating system (BIOS,
Firmware, Diagnostics, etc.)"
Note: If the "Cross operating system ..." link is not present, select
applicable Windows operating system from the list.
Select the appropriate firmware update under "Firmware".
Firmware Updates Table
Product Name
Model Number
Firmware Revision
HP Color LaserJet CP5525
CE707A,CE708A,CE709A
2305081_000127 (or higher)
HP Color LaserJet Enterprise M552
B5L23A
2305076_518484 (or higher)
HP Color LaserJet Enterprise M553
B5L24A, B5L25A, B5L26A
2305076_518484 (or higher)
HP Color LaserJet Enterprise M651
CZ255A, CZ256A, CZ257A, CZ258A
2305076_518492 (or higher)
HP Color LaserJet Enterprise M750
D3L08A, D3L09A, D3L10A
2305081_000144 (or higher)
HP Color LaserJet M680
CZ250A, CA251A
2305076_518489 (or higher)
HP LaserJet Enterprise 500 color MFP M575dn
CD644A, CD645A
2305076_518499 (or higher)
HP LaserJet Enterprise 500 MFP M525f
CF116A, CF117A
2305076_518487 (or higher)
HP LaserJet Enterprise 600 M601
CE989A, CE990A
2305083_000199 (or higher)
HP LaserJet Enterprise 600 M602
CE991A, CE992A, CE993A
2305083_000199 (or higher)
HP LaserJet Enterprise 600 M603xh
CE994A, CE995A, CE996A
2305083_000199 (or higher)
HP LaserJet Enterprise 700 color MFP M775 series
CC522A, CC523A, CC524A
2305076_518498 (or higher)
HP LaserJet Enterprise 700 M712xh
CF235A, CF236A, CF238A
2305083_000196 (or higher)
HP LaserJet Enterprise 800 color M855
A2W77A, A2W78A, A2W79A
2305076_518493 (or higher)
HP LaserJet Enterprise 800 color MFP M880
A2W76A, A2W75A, D7P70A, D7P71A
2305076_518488 (or higher)
HP LaserJet Enterprise Color 500 M551 Series
CF081A,CF082A,CF083A
2305083_000200 (or higher)
HP LaserJet Enterprise Color flow MFP M575c
CD646A
2305076_518499 (or higher)
HP LaserJet Enterprise flow M830z MFP
CF367A
2305076_518490 (or higher)
HP LaserJet Enterprise flow MFP M525c
CF118A
2305076_518487 (or higher)
HP LaserJet Enterprise Flow MFP M630z
B3G85A
2305076_518483 (or higher)
HP LaserJet Enterprise M4555 MFP
CE503A, CE504A, CE738A
2305083_000222 (or higher)
HP Color LaserJet CM4540 MFP
CC419A, CC420A, CC421A
2305083_000206 (or higher)
HP LaserJet Enterprise M604
E6B67A, E6B68A
2305076_518485 (or higher)
HP LaserJet Enterprise M605
E6B69A, E6B70A. E6B71A
2305076_518485 (or higher)
HP LaserJet Enterprise M606
E6B72A, E6B73A
2305076_518485 (or higher)
HP LaserJet Enterprise M806
CZ244A, CZ245A
2305081_000143 (or higher)
HP LaserJet Enterprise MFP M630
J7X28A
2305076_518483 (or higher)
HP LaserJet Enterprise MFP M725
CF066A, CF067A, CF068A, CF069A
2305076_518496 (or higher)
HP Scanjet Enterprise 8500FN1 Document Capture Workstation
L2717A
2305076_518479 (or higher)
HP OfficeJet Enterprise Color X555
C2S11A, C2S12A
2305076_518491 (or higher)
HP OfficeJet Enterprise Color MFP X585
B5L04A, B5L05A,B5L07A
2305076_518486 (or higher)
HP LaserJet P3005
Q7812A
02.190.3 (or higher)
HP Color LaserJet CP3505
CB442A
03.160.2 (or higher)
HP LaserJet 5200L
Q7543A
08.241.0 (or higher)
HP LaserJet 5200N
Q7543A
08.241.0 (or higher)
HP LaserJet 4240
Q7785A
08.250.2 (or higher)
HP LaserJet 4250
Q5400A
08.250.2 (or higher)
HP LaserJet 4350
Q5407A
08.250.2 (or higher)
HP LaserJet 9040
Q7697A
08.260.3 (or higher)
HP LaserJet 9050
Q7697A
08.260.3 (or higher)
HP LaserJet 9040 Multifunction Printer
Q3721A
08.290.2 (or higher)
HP LaserJet 9050 Multifunction Printer
Q3721A
08.290.2 (or higher)
HP 9200c Digital Sender
Q5916A
09.271.3 (or higher)
HP LaserJet 4345 Multifunction Printer
Q3942A
09.310.2 (or higher)
HP LaserJet P2055 Printer
CE456A, CE457A, CE459A, CE460A,
20141201 (or higher)
HP Color LaserJet 3000
Q7534A
46.080.2 (or higher)
HP Color LaserJet 3800
Q5981A
46.080.8 (or higher)
HP Color LaserJet 4700
Q7492A
46.230.6 (or higher)
HP Color LaserJet CP4005
CB503A
46.230.6 (or higher)
HP Color LaserJet 4730 Multifunction Printer
Q7517A
46.380.3 (or higher)
HP LaserJet Pro 200 color Printer M251n, nw
CF146A, CF147A
20150112 (or higher)
HP LaserJet Pro 500 color MFP M570dn, dw
CZ271A, CZ272A
20150112 (or higher)
HP LaserJet Pro M521dn, dw MFP
A8P79A, A8P80A
20150112 (or higher)
HP Color LaserJet Pro MFP M476dn, dw, nw
CF385A, CF386A, CF387A
20150112 (or higher)
HP LaserJet Pro 400 MFP M425dn, dw
CF286A, CF28A
20150112 (or higher)
HP LaserJet Pro 200 color MFP M276n, nw
CF144A, CF145A
20150112 (or higher)
HP LaserJet Pro 400 M401a, d, dn, dne, dw, n
CF270A, CF274A, CF278A, CF399A, CF285A, CZ195A
20150112 (or higher)
HP LaserJet Pro P1566 Printer
CE663A, CE749A
20150116 (or higher)
HP LaserJet Pro 300 Color MFP M375nw
CE903A
20150126 (or higher)
HP LaserJet Pro 400 Color MFP M475dn, dw
CE863A, CE864A
20150126 (or higher)
HP TopShot LaserJet Pro M275 MFP
CF040A
20150126 (or higher)
HP LaserJet 300 color M351a
CE955A
20150126 (or higher)
HP LaserJet 400 color M451dn, dw, nw
CE956A, CE957A, CE958A
20150126 (or higher)
HP LaserJet Pro MFP M125a
CZ172A
20150214 (or higher)
HP LaserJet Pro MFP M126a
CZ174A
20150215 (or higher)
HP LaserJet Pro MFP M125nw
CZ173A
20150228 (or higher)
HP LaserJet Pro MFP M126nw
CZ175A
20150228 (or higher)
HP LaserJet Pro MFP M127fn, fw
CZ181A, CZ183A
20150228 (or higher)
HP LaserJet Pro MFP M128fn, fp, fw
CZ184A, CZ185A, CZ186A
20150228 (or higher)
HP Color LaserJet Pro MFP M176n, fw
CF547A, CZ165A
20150228 (or higher)
HP LaserJet Pro P1102, w
CE651A, CE657A
20150313 (or higher)
HP LaserJet Pro P1106
CE653A
20150313 (or higher)
HP LaserJet Pro P1108
CE655A
20150313 (or higher)
LaserJet Pro M435nw MFP
A3E42A
20150316 (or higher)
HP LaserJet Pro M701a, n
B6S00A, B6S01A
20150316 (or higher)
HP LaserJet Pro M706n
B6S02A
20150316 (or higher)
HP LaserJet Professional M1212nf MFP
CE841A
20150405 (or higher)
HP LaserJet Professional M1213nf MFP
CE845A
20150405 (or higher)
HP LaserJet Professional M1214nfh MFP
CE843A
20150405 (or higher)
HP LaserJet Professional M1216nfh MFP
CE842A
20150405 (or higher)
HP LaserJet Professional M1217nfw MFP
CE844A
20150405 (or higher)
HP HotSpot LaserJet Pro M1218nfs MFP
B4K88A
20150405 (or higher)
HP LaserJet Professional M1219nf MFP
CE846A
20150405 (or higher)
HP LaserJet Pro CP1025, nw
CE913A, CE914A, CF346A, CF346A
20150413 (or higher)
HP Officejet Pro X451dn Printer
CN459A
BNP1CN1502AR (or higher)
HP Officejet Pro X451dw Printer
CN463A
BWP1CN1502AR (or higher)
HP Officejet Pro X551dw Printer
CV037A
BZP1CN1502AR (or higher)
HP Officejet Pro X476dn MFP
CN460A
LNP1CN1502BR (or higher)
HP Officejet Pro X476dw MFP
CN461A
LWP1CN1502BR (or higher)
HP Officejet Pro X576dw MFP
CN598A
LZP1CN1502BR (or higher)
HP Officejet Pro 276dw MFP
CR770A
FRP1CN1517AR (or higher)
HP Officejet Pro 8610/15/16 e-All-in-One Printer
A7F64A, D7Z36A, J5T77A
FDP1CN1502AR (or higher)
HP Officejet Pro 8620/25 e-All-in-One Printer
A7F65A, D7Z37A
FDP1CN1502AR (or higher)
HP Officejet Pro 8630 e-All-in-One Printer
A7F66A
FDP1CN1502AR (or higher)
HP Jetdirect 620n EIO Card
J7934G
V29.26 (or higher)
HP Jetdirect ew2500 802.11b/g Wireless Print Server
J8021A
V41.16 (or higher)
HP Jetdirect 690n EIO Card
J8007A
V41.16 (or higher)
HP Jetdirect 635n EIO Card
J7961G
V41.16 (or higher)
HP Jetdirect 695n EIO Card
J8024A
V41.16 (or higher)
HP Jetdirect 640n EIO Card
J8025A
V45.35 (or higher)
HISTORY
Version:1 (rev.1) - 26 June 2015 Initial release
Version:2 (rev.2) - 26 June 2015 Corrected HPSB ID in the document title
Third Party Security Patches: Third party security patches that are to be
installed on systems running HP software products should be applied in
accordance with the customer's patch management policy.
Support: For issues about implementing the recommendations of this Security
Bulletin, contact normal HP Services support channel. For other issues about
the content of this Security Bulletin, send e-mail to security-alert@hp.com.
Report: To report a potential security vulnerability with any HP supported
product, send Email to: security-alert@hp.com
Subscribe: To initiate a subscription to receive future HP Security Bulletin
alerts via Email:
http://h41183.www4.hp.com/signup_alerts.php?jumpid=hpsc_secbulletins
Security Bulletin Archive: A list of recently released Security Bulletins is
available here:
https://h20564.www2.hp.com/portal/site/hpsc/public/kb/secBullArchive/
Software Product Category: The Software Product Category is represented in
the title by the two characters following HPSB.
3C = 3COM
3P = 3rd Party Software
GN = HP General Software
HF = HP Hardware and Firmware
MP = MPE/iX
MU = Multi-Platform Software
NS = NonStop Servers
OV = OpenVMS
PI = Printing and Imaging
PV = ProCurve
ST = Storage Software
TU = Tru64 UNIX
UX = HP-UX
Copyright 2015 Hewlett-Packard Development Company, L.P.
Hewlett-Packard Company shall not be liable for technical or editorial errors
or omissions contained herein. The information provided is provided "as is"
without warranty of any kind. To the extent permitted by law, neither HP or
its affiliates, subcontractors or suppliers will be liable for
incidental,special or consequential damages including downtime cost; lost
profits; damages relating to the procurement of substitute products or
services; or damages for loss of data, or software restoration. The
information in this document is subject to change without notice.
Hewlett-Packard Company and the names of Hewlett-Packard products referenced
herein are trademarks of Hewlett-Packard Company in the United States and
other countries. Other product and company names mentioned herein may be
trademarks of their respective owners.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.19 (GNU/Linux)
iEYEARECAAYFAlWNrBsACgkQ4B86/C0qfVnNFgCfZqtNDItWyG+2NfC3L9b18roE
tWAAoKSoihuB+TerbSYLddG21lgXh2HI
=52dK
-----END PGP SIGNATURE-----
