{"id": "CVE-2004-2166", "bulletinFamily": "NVD", "title": "CVE-2004-2166", "description": "The print-from-email feature in the Canon ImageRUNNER (iR) 5000i and C3200 digital printer, when not using IP address range filtering, allows remote attackers to print arbitrary text without authentication via a text/plain email to TCP port 25.", "published": "2004-12-31T05:00:00", "modified": "2017-07-11T01:31:00", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}, "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2004-2166", "reporter": "cve@mitre.org", "references": ["http://www.securityfocus.com/archive/1/376242", "http://secunia.com/advisories/12659/", "https://exchange.xforce.ibmcloud.com/vulnerabilities/17512", "http://www.securityfocus.com/bid/11247"], "cvelist": ["CVE-2004-2166"], "type": "cve", "lastseen": "2019-05-29T18:08:04", "history": [], "edition": 1, "hashmap": [{"key": "affectedSoftware", "hash": "6261e361e46146f58f3601fb191da9a3"}, {"key": "bulletinFamily", "hash": "601892ece72be3be2f57266ca2354792"}, {"key": "cpe", "hash": "136b8da1480f4446a8c6b3797c6334ca"}, {"key": "cpe23", "hash": "ca0a1a6845e486cc791816cdfaf6ac7f"}, {"key": "cvelist", "hash": "fa777907e906e044daede8e8fd58cd9d"}, {"key": "cvss", "hash": "0b053db5674b87efff89989a8a720df3"}, {"key": "cvss2", "hash": "7f7c77d2dde7216a66d00321bd5828f8"}, {"key": "cvss3", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "cwe", "hash": "78a7a5cbaf09985c14389298e454e7db"}, {"key": "description", "hash": "f8fd18ed7fb29230ce973837f7ba1ff4"}, {"key": "href", "hash": "6fdcef7ee44d524e05fc68e11883278e"}, {"key": "modified", "hash": "523ab2b584257b356b93ab54fd2d1554"}, {"key": "published", "hash": "3f051342f862f2833e883053d29ea929"}, {"key": "references", "hash": "f530368890ad3ee2b290b5d253f6961f"}, {"key": "reporter", "hash": "444c2b4dda4a55437faa8bef1a141e84"}, {"key": "title", "hash": "cf0b3acedded597330d9cf28b03374f8"}, {"key": "type", "hash": "1716b5fcbb7121af74efdc153d0166c5"}], "hash": "56437c7af222431ecc40b07abeaa812e83fb8a8c42664f90b763af10f5673070", "viewCount": 0, "enchantments": {"dependencies": {"references": [{"type": "nessus", "idList": ["CANON_PRINT_BY_SMTP.NASL"]}, {"type": "osvdb", "idList": ["OSVDB:9346"]}], "modified": "2019-05-29T18:08:04"}, "score": {"value": 6.1, "vector": "NONE", "modified": "2019-05-29T18:08:04"}, "vulnersScore": 6.1}, "objectVersion": "1.3", "cpe": ["cpe:/a:canon:imagerunner_c3200:*", "cpe:/a:canon:imagerunner_5000i:*"], "affectedSoftware": [{"name": "canon imagerunner_c3200", "operator": "eq", "version": "*"}, {"name": "canon imagerunner_5000i", "operator": "eq", "version": "*"}], "cvss2": {"cvssV2": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": true, "obtainUserPrivilege": false, "severity": "HIGH", "userInteractionRequired": false}, "cvss3": {}, "cpe23": ["cpe:2.3:a:canon:imagerunner_c3200:*:*:*:*:*:*:*:*", "cpe:2.3:a:canon:imagerunner_5000i:*:*:*:*:*:*:*:*"], "cwe": ["NVD-CWE-Other"]}

{"nessus": [{"lastseen": "2019-11-01T02:15:02", "bulletinFamily": "scanner", "description": "The remote host seems to be a Canon ImageRUNNER printer, which runs a\nSMTP service.\n\nIt is possible to send an email to the SMTP service and have it\nprinted out. An attacker may use this flaw to send an endless stream\nof emails to the remote device and cause a denial of service by using\nall of the print paper.", "modified": "2019-11-02T00:00:00", "id": "CANON_PRINT_BY_SMTP.NASL", "href": "https://www.tenable.com/plugins/nessus/14819", "published": "2004-09-24T00:00:00", "title": "Canon ImageRUNNER SMTP Arbitrary Content Printing", "type": "nessus", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n\n# A big thanks to Andrew Daviel\n#\n\n\ninclude(\"compat.inc\");\n\n\nif(description)\n{\n script_id(14819);\n script_version (\"1.21\");\n script_cve_id(\"CVE-1999-0564\", \"CVE-2004-2166\");\n script_bugtraq_id(11247);\n\n script_name(english:\"Canon ImageRUNNER SMTP Arbitrary Content Printing\");\n script_summary(english:\"Determines if the remote host is a Canon ImageRUNNER Printer\");\n \n script_set_attribute(\n attribute:\"synopsis\",\n value:\"The remote printer has a denial of service vulnerability.\"\n );\n script_set_attribute( attribute:\"description\", value:\n\"The remote host seems to be a Canon ImageRUNNER printer, which runs a\nSMTP service.\n\nIt is possible to send an email to the SMTP service and have it\nprinted out. An attacker may use this flaw to send an endless stream\nof emails to the remote device and cause a denial of service by using\nall of the print paper.\" );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://seclists.org/bugtraq/2004/Sep/322\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Disable the email printing service via the device's web interface.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:ND/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n script_set_attribute(attribute:\"plugin_publication_date\", value: \"2004/09/24\");\n script_set_attribute(attribute:\"vuln_publication_date\", value: \"2004/09/23\");\n script_cvs_date(\"Date: 2018/11/15 20:50:24\");\n script_set_attribute(attribute:\"plugin_type\", value:\"remote\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"SMTP problems\");\n \n script_copyright(english:\"This script is Copyright (C) 2004-2018 Tenable Network Security, Inc.\");\n \n script_dependencie(\"smtpserver_detect.nasl\");\n script_require_ports(\"Services/smtp\", 25);\n exit(0);\n}\n\n#\n# The script code starts here\n#\n\ninclude(\"smtp_func.inc\");\n\n\nport = get_kb_item(\"Services/smtp\");\nif(!port)port = 25;\n\nsoc = open_sock_tcp(port);\nif ( ! soc ) exit(0);\n\nbanner = smtp_recv_line(socket:soc);\nif ( ! banner ) exit(0);\n\nif ( !ereg(pattern:\"^220 .* SMTP Ready.$\", string:banner ) ) exit(0);\nsend(socket:soc, data:'EHLO there\\r\\n');\nr = smtp_recv_line(socket:soc);\nif ( ! ereg(pattern:\"^550 Command unrecognized\", string:banner) ) exit(0);\nsend(socket:soc, data:'HELO there\\r\\n');\nr = smtp_recv_line(socket:soc);\nif ( ! ereg(pattern:\"^250 . Hello there \\[[0-9]+\\.[0-9]+\\.[0-9]+\\.[0-9]+\\] please to meet you\\.\", string:banner) ) exit(0);\n\nsend(socket:soc, data:'RCPT TO: nessus\\r\\n');\nr = smtp_recv_line(socket:soc);\nif ( ! ereg(pattern:\"^503 need MAIL From: first\\.\", string:r) ) exit(0);\n\nsend(socket:soc, data:'MAIL FROM: nessus\\r\\n');\nr = smtp_recv_line(socket:soc);\nif ( ! ereg(pattern:\"^250 nessus\\.\\.\\. Sender Ok\", string:r) ) exit(0);\nsend(socket:soc, data:'RCPT TO: nessus\\r\\n');\nr = smtp_recv_line(socket:soc);\nif ( ! ereg(pattern:\"^250 nessus\\.\\.\\. Receiver Ok\", string:r) ) exit(0);\n\nsecurity_warning(port);\n", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}], "osvdb": [{"lastseen": "2017-04-28T13:20:04", "bulletinFamily": "software", "description": "## Vulnerability Description\nPrinter allows unauthenticated users to print documents via multiple methods.\n## Short Description\nPrinter allows unauthenticated users to print documents via multiple methods.\n## References:\n[Secunia Advisory ID:12659](https://secuniaresearch.flexerasoftware.com/advisories/12659/)\nMail List Post: http://archives.neohapsis.com/archives/bugtraq/2004-09/0320.html\nMail List Post: http://archives.neohapsis.com/archives/bugtraq/2004-09/0307.html\nMail List Post: http://archives.neohapsis.com/archives/bugtraq/2004-09/0386.html\nISS X-Force ID: 17512\n[CVE-1999-0564](https://vulners.com/cve/CVE-1999-0564)\n[CVE-2004-2166](https://vulners.com/cve/CVE-2004-2166)\n", "modified": "1999-06-07T00:00:00", "published": "1999-06-07T00:00:00", "id": "OSVDB:9346", "href": "https://vulners.com/osvdb/OSVDB:9346", "title": "Printer Allows Unauthenticated Printing", "type": "osvdb", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}]}