Our vendor (reseller) provided this fix: Go to service mode level 2 Copier/Option/User/CTM-S06 set from 0 to 1. By changing this setting in copier there will be no passwords exposed, but when you import into another unit a password will have to be entered at the new location. Their tech executed this on our Canon ImageRunner 4570. The "pwd:" line that used to display the SMB password no longer appears in the exported address book (although the username line still appears). Assume it would work on other models. -- Jill George -----Original Message----- From: gunrnr@xxxxxxxxxxxxx [mailto:gunrnr@xxxxxxxxxxxxx] Sent: Tuesday, September 05, 2006 7:11 PM To: bugtraq@xxxxxxxxxxxxxxxxx Subject: Canon ImageRunner reveals SMB, IPX, and FTP username/passwords The Canon ImageRunner multi-function device?s Remote UI web interface software will reveal username and password pairs contained in address book entries when the address book is exported. These address book entries are used for scanning to SMB, FTP, or IPX shares. In addition, passwords for password protected fax entries will be revealed. This security flaw was brought to Canon's attention through its vendor Ikon. Canon's recommendation is to enable the system manager ID to restrict access to the web interface. However, this is a limited security measure for if there are users that have access to that portion of the web interface but shouldn't have access to the usernames and passwords stored in the device, this will not protect against such. Also, if the system manager ID and password is compromised it will make accessible the user names and password pairs stored on the device. Tested and verified on Canon iR C3220, iR 5020, iR9070, iR C6800, iR C6870, and iR 8500. Also, machines running the Fiery software have the same exploit as the Fiery software works in conjunction with the Remote UI software. As the Remote UI software is the same across many machines, it is likely that the problem exists in all devices running Remote UI. Following is an example of an exported address book: === # Canon AddressBook version: 1 # CharSet: WCP1252 # SubAddressBookName: dn: 201 cn: FTP address cnread: FTP address url: ftp.myftpserver.com path: ftpdir/ username: foo pwd: bar accesscode: 0 protocol: ftp objectclass: top objectclass: extensibleobject objectclass: remotefilesystem dn: 202 cn: Fax address cnread: Fax address dialdata: 5551212 pwd: 123456789 txstartspeed: 33600 commode: domestic lineselect: auto faxprotocol: g4 accesscode: 0 protocol: t30 objectclass: top objectclass: extensibleobject objectclass: g3fax dn: 203 cn: SMB address cnread: SMB address url: smb.mysmbserver.com path: pathtoshare/ username: foo pwd: bar accesscode: 0 protocol: smb objectclass: top objectclass: extensibleobject objectclass: remotefilesystem dn: 204 cn: IPX Address cnread: IPX Address url: ipx.myipxserver.com path: pathtoshare/ username: foo pwd: bar accesscode: 0 protocol: ipx objectclass: top objectclass: extensibleobject objectclass: remotefilesystem === -GR
