Revision: 1.1 Last update: 21 July 2014 Public Release Date: 28 July 2014

Multiple OpenSSL vulnerabilities

Recently announced vulnerabilities in OpenSSL allow for possible attacks against the SSL & TLS protocols. These vulnerabilities affect multiple Lexmark products.

This advisory will be updated as additional information becomes available.

CVE:

On June 5, 2014 the OpenSSL Project released a security advisory detailing multiple vulnerabilities. These vulnerabilities include:

A remote attacker with the ability to intercept and inject traffic between a vulnerable client and server could successfully force the SSL/TLS protocols to use a known session key, thus rendering the content of those communications vulnerable to interception and modification.

CVSS Base Score:

6.8

(AV:N/AC:M/AU:N/C:P/I:P/A:P) Impact Subscore: 6.4 Exploitability Subscore: 8.6

Sending an invalid DTLS handshake can cause a crash leading to a denial of service attack.

NOTE:

No Lexmark products support the DTLS protocol; therefore no Lexmark products are vulnerable to this issue.

A buffer overrun can be triggered by sending an invalid DTLS fragment.

NOTE:

No Lexmark products support the DTLS protocol; therefore no Lexmark products are vulnerable to this issue.

A remote attacker could send a specially crafted packet that would trigger a crash leading to a denial of service attack.

CVSS Base Score:

4.3

(AV:N/AC:M/AU:N/C:N/I:N/A:P) Impact Subscore: 2.9 Exploitability Subscore: 8.6

A remote attacker could send a specially crafted packet that would trigger a crash leading to a denial of service attack.

CVSS Base Score:

4.0

(AV:N/AC:H/AU:N/C:N/I:P/A:P) Impact Subscore: 4.9 Exploitability Subscore: 4.9

A remote attacker could trigger a crash leading to a denial of service attack.

CVSS Base Score:

4.3

(AV:N/AC:M/AU:N/C:N/I:N/A:P) Impact Subscore: 2.9 Exploitability Subscore: 8.6

ECDSA nonce is vulnerable to a timing based side channel attack.

CVSS Base Score:

4.3

(AV:N/AC:M/AU:N/C:PI:N/A:N) Impact Subscore: 2.9 Exploitability Subscore: 8.6

CVSS scores are calculated in accordance with

CVSS version 2.0

(http://www.first.org/cvss/cvss-guide.html).

The impact of this vulnerability varies depending on the affected product.

The following products have been investigated and are not affected by this vulnerability:

The following products are known to be affected, for specific details see “

Product Specific Information

” below.

Lexmark is individually assessing each product and will update this advisory as more information becomes available.

The following printers and MFPs are affected:

To determine the level of firmware a device is running, from the control panel select

Menu

>

Reports

>

Menu Settings Page

. If the firmware is listed under “

Affected Releases

”, update to a “

Fixed Release

”.

Only the devices listed above are affected, all other devices are not affected.

Lexmark recommends a firmware update if your device has affected firmware.

To obtain the firmware that resolves this issue or if you have special code, please contact

Lexmark Technical Support

at Lexmark Support website, go to your product's support page and locate

Get In Touch with Lexmark!

for contact information.

Applications running on Lexmark Document Distributor (LDD) versions 4.8.3 or later are not vulnerable, all earlier versions of LDD are vulnerable. A patch is available for the vulnerable versions of LDD that upgrades the OpenSSL library to version 1.0.1h.

Lexmark recommends applying the patch if you have a vulnerable version.

To obtain the patch and installation instructions to resolve this issue, please contact your

Lexmark Solutions Help Desk

.

The on-premise version of the Lexmark Print Management application version 2.3.14.0 (or later) is not vulnerable, but versions 2.3.13 and previous are known to be vulnerable.

Lexmark recommends updating the application if you have a vulnerable version.

To obtain software and installation instructions to resolve this issue, please contact your

Lexmark Solutions Help Desk

.

Lexmark Fleet Manager 3.0 is not vulnerable, but Lexmark Fleet Manager 2.0 is.

An updated version of LFM 2.0 that fixes the vulnerability has been posted, and is available for immediate or automatic updating. The fixed versions of the affected LFM components are:

Lexmark recommends updating the affected components if you have a vulnerable version.

Updates for Lexmark Fleet Manager 2.0 are automatically distributed via the activation server. To obtain instructions on how to perform manual update, please contact

Lexmark Technical Support

at Lexmark Support website, go to your product's support page and locate

Get In Touch with Lexmark!

for contact information.

Perceptive Content versions 6.6, 6.7, and 6.8 are vulnerable when using Envoy to make outbound calls with SSL enabled.

Modify the server being called to use a non-vulnerable version of OpenSSL.

An update is not currently available. Perceptive Software plans to resolve this vulnerability in a future release.

Perceptive Enterprise Search, versions 10.0, 10.1, 10.2, and 10.3 are vulnerable.

Perceptive recommends applying the patch.

Perceptive Search 10.x OpenSSL 1.0.1h Patch is available via the Perceptive Software Customer Portal. (www.perceptivesoftware.com) This patch will be included in Perceptive Enterprise Search 10.4.

Perceptive Process, versions 2.8, 2.9, 3.0, and 3.1 are vulnerable on the Windows platform. On the UNIX platform Perceptive Process utilizes the OpenSSL libraries that are part of the platform and therefore patching OpenSSL on the platform will address the vulnerability.

There are currently no workarounds.

An update is not currently available. Perceptive Software plans to have this rectified in Perceptive Process 3.3.

Lexmark is not aware of any malicious use of the vulnerabilities described in this advisory.

This document is provided on an "as is" basis and is provided without any express or implied guarantee or warranty whatsoever, including but not limited to the warranties of merchantability and fitness for a particular use or purpose. Lexmark reserves the right to change or update this document at any time.

This advisory is posted on Lexmark’s web site at http://support.lexmark.com/alerts.

Future updates to this document will be posted on Lexmark’s web site at the same location.

LEGACY ID:

TE626

Escalation Item #

330690

,

331893

, and

330837

330690

331893

330837

NOTE:

This escalation item number is provided for investigative purposes. To view this item, you will need at least

Escalation Reader

access to ExtraView.