HP Printer Buffer Overflow (CVE-2006-6742)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(505340);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/05/26");

  script_cve_id("CVE-2006-6742");

  script_name(english:"HP Printer Buffer Overflow (CVE-2006-6742)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"Multiple buffer overflows in FTP Print Server 2.4 and 2.4.5 in HP
LaserJet 5000 Series printers with firmware R.25.15 or R.25.47, and HP
LaserJet 5100 Series printers with firmware V.29.12, allow remote
attackers to cause a denial of service (device crash) via a long
string in the (1) LIST or (2) NLST command.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  script_set_attribute(attribute:"see_also", value:"http://securityreason.com/securityalert/2074");
  script_set_attribute(attribute:"solution", value:
"Refer to the vendor advisory.");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2006-6742");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2006/12/26");
  script_set_attribute(attribute:"patch_publication_date", value:"2006/12/26");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/04/30");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/h:hp:laserjet_5000:r.25.15");
  script_set_attribute(attribute:"cpe", value:"cpe:/h:hp:laserjet_5000:r.25.47");
  script_set_attribute(attribute:"cpe", value:"cpe:/h:hp:laserjet_5100:v.29.12");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/HP");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/HP');

var asset = tenable_ot::assets::get(vendor:'HP');

var vuln_cpes = {
    "cpe:/h:hp:laserjet_5000:r.25.15" :
        {"versionEndIncluding" : "r.25.15", "versionStartIncluding" : "r.25.15", "family" : "LaserJet"},
    "cpe:/h:hp:laserjet_5000:r.25.47" :
        {"versionEndIncluding" : "r.25.47", "versionStartIncluding" : "r.25.47", "family" : "LaserJet"},
    "cpe:/h:hp:laserjet_5100:v.29.12" :
        {"versionEndIncluding" : "v.29.12", "versionStartIncluding" : "v.29.12", "family" : "LaserJet"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_HOLE);