55

This question already has an answer here:

We discovered a vulnerability in wide range of Ricoh printers, where with a simple PostScript file sent directly, it is possible to crash the device.

To recover you need physical access to the printer and an administration account to clear the queue (otherwise, after the restart, the crash will occur again).

This offers a simple and quick denial of service attack. If you are in the right network, you can disable all the printers within seconds.

We tried to contact Ricoh for months (but we were more or less silently ignored) and we finally where able to speak with the responsible person in our country. He stated that he does not see the problem.

Given that we are following the rules of responsible disclosure (Ricoh was warned month ago) and that they clearly stated that they will not address the problem: where should we disclose the problem?

marked as duplicate by Xander, forest, MechMK1, Dmitry Grigoryev, Royce Williams Sep 13 at 14:19

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • As someone who spent a long time working on a service desk supporting printers like this, it really doesn't surprise me, and I suspect Ricoh are already aware of this issue. We'd regularly have to get the support contractors to go directly into printer queues and clear jobs like this, which we couldn't clear via any of the normal support methods. The support contractors were the ones with contracts with various printer manufacturers, who had the correct details etc to get into the 'indepth' parts of the printer management. – djsmiley2k Sep 12 at 12:41
  • 3
    Reddit is a good place for this I guess. – hek2mgl Sep 12 at 14:17
  • 5
    Btw, if the attack requires you to have an access to the printer that allows you to print, you could simply dos the printer by letting it print a huge amount of papers. – hek2mgl Sep 12 at 14:20
  • @hek2mgl. This sounds much more environmentally friendly :) – Mad Physicist Sep 12 at 20:46
  • 2
    Seems like you've already decided the answer is "Stack Exchange". (And yes, you haven't disclosed the exact procedure, but disclosing the target, attack surface, and effect is a rather large chunk of the disclosure.) – Acccumulation Sep 12 at 21:52
37

You should request a CVE ID from MITRE (https://cve.mitre.org/cve/request_id.html), which is the responsible CNA for this.

You can then disclose it on security mailing lists like Bugtraq or FullDisclosure. Security magazines and news sites might also be interested in the vulnerability. You can contact them directly and ask if they are interested to publish the vulnerability. Though they likely follow Bugtraq and FullDisclosure anyways.

  • 2
    The CVE can be requested only after the disclosure. – Matteo Sep 12 at 6:49
  • 2
    @Matteo So disclose it at the same time. – forest Sep 12 at 7:32
  • 9
    @Matteo: I don't think you need to disclose it before getting a CVE ID. The CVE form says "Once a CVE ID is assigned to your vulnerability, it will not be published in the CVE List until you have submitted a URL pointing to public information about the vulnerability. Without a public reference, the CVE ID will display as "RESERVED" in the CVE List." – Jan Fabry Sep 12 at 8:20
  • 6
    @Matteo You may also wish to check that this hasn't already been reported – Lightness Races in Orbit Sep 12 at 11:18
  • @Matteo no, you can either request a CVE and then disclose the vulnerability or disclose the vulnerability right away and then get a CVE. I prefer the former way, because its better in some cases (e.g. when you want to discuss the vulnerability before disclosing it). But in principle both ways are possible. – D.O. Sep 16 at 11:06
10

If you want to disclose a vulnerability I would suggest to contact the right CNA. You can find a list under this link. Now you can request a CVE ID and everything goes on if this vulnerability is really existing.

-1

Anywhere you like, if at all.

Ricoh MFPs can lock up if you look at them funny, let alone send them a specially crafted postscript file. If you've found yet another way of making them crash perhaps post about it on your favourite comment site/write it up on your blog but it's probably not going to get Ricoh or their customers particularly bothered (as you've found) and probably won't get assigned a CVE.

There don't currently appear to be any CVEs raised where the only risk is of a device crashing for instance: https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=ricoh

I run around a dozen Ricoh MFPs which the whole of my network can send postscript files to directly and yet this discovery has elicited no reaction from any of my team. If they did patch it most printers wouldn't get the fix for years by the time they had analysed the issue, made a new firmware, affected devices had been replaced or undergone maintenance resulting in the latest firmware being applied. This isn't the sort of issue that would call for a critical advisory and immediate application of patch sadly, if you're in a position to send print jobs directly to the printer you're in a position to DoS it (not to mention additionally wasting materials/creating sub2pewdiepie pages) by sending it print jobs?

Also worth considering: If they aren't going to fix it and any fixes they do make won't make it to the vast majority of affected devices, perhaps the most responsible thing is to not disclose the specific details of vulnerability at all?

And to the person that said mentioning that it's a Ricoh device crashing, that it's annoying to fix once it does, that it involves sending a postscript file to it, is so specific as to be almost disclosing the fault itself? The information contained in the original text is about as dangerous as a locksmith revealing that you can jam a certain brand of lock by directly inserting a malformed key. It's both highly generic and highly predictable as far as I can imagine?

Not the answer you're looking for? Browse other questions tagged or ask your own question.