|Public Release Date:||2-July-2021|
The Lexmark Printer Software G2, G3 and G4 Installation Packages have a local escalation of privilege vulnerability due to a registry entry that has an unquoted service path.
The Windows version of the Lexmark Printer Software G2, G3 and G4 Installation Packages install a service named LM__bdsvc that runs with system privileges. Unpatched versions of the installation packages do not quote the fully qualified path name for the LM__bdsvc executable during installation. Since the installation path is in the directory “C:\Program Files\...” if an attacker installed a program named “C:\Program” it would execute, with SYSTEM privileges, when the system attempts to launch the LM__bdsvc service.
Updating the G2, G3 or G4 Installation Packages will correct the issue.
The LM__bdsvc service is used by the Lexmark “Status Center” application to communicate to Lexmark printers over USB. LM__bdsvc is only installed if the Lexmark “Status Center” application is installed.
|CVSSv3 Base Score||7.8||(AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)|
CVSSv3 scores are calculated in accordance with CVSS version 3.1 (https://www.first.org/cvss/user-guide)
Successful exploitation of this vulnerability can lead to attacker-controlled code running with SYSTEM privileges.
Lexmark Printer Software G2 Installation Package 18.104.22.168 and previous versions.
Lexmark Printer Software G3 Installation Package 22.214.171.124 and previous versions.
Lexmark Printer Software G4 Installation Package 126.96.36.199 and previous versions.
Obtaining Updated Software
To obtain Lexmark Printer Software G2, G3, or G4 Installation Package version 188.8.131.52, please visit:
Otherwise contact Lexmark’s Technical Support Center at http://support.lexmark.com to find your local support center.
- Lexmark Printer Software G2 Installation Package version 184.108.40.206
- Lexmark Printer Software G3 Installation Package version 220.127.116.11
- Lexmark Printer Software G4 Installation Package version 18.104.22.168
Lexmark recommends updating the application if you have a vulnerable version, but the following workaround can be utilized as a temporary measure.
If updating the application is not possible, manually editing the “ImagePath” registry entry in the “Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LM__bdsvc” registry key to add quotes around the fully qualified path name will resolve the issue.
Exploitation and Public Announcements
Lexmark is not aware of any malicious use against Lexmark products of the vulnerability described in this advisory.
Status of this Notice:
THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND IS PROVIDED WITHOUT ANY EXPRESS OR IMPLIED GUARANTEE OR WARRANTY WHATSOEVER, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR USE OR PURPOSE. LEXMARK RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME.
This advisory is posted on Lexmark’s web site at http://support.lexmark.com/alerts
Future updates to this document will be posted on Lexmark’s web site at the same location.
|1.0||29 - June- 2021||Initial Public Release|