Lexmark Printers Open to Arbitrary Code-Execution Zero-Day

[silversurfer]

Lexmark printers – those ubiquitous, inky office workhorses that fill homes and offices, and are found all the way on up to the federal government – have an unpatched vulnerability that could lead to serious, easy-to-execute attacks that require neither privileges nor user interaction and which can lead to arbitrary code execution.
 
According to an advisory filed by researcher Julio Aviña on the IBM X-Force Exchange, the flaw could lead to a low-complexity attack that could allow a local attacker to execute arbitrary code. The vulnerability’s CVSS 3.0 base score is high, at 8.4. Fortunately, it doesn’t appear to have been exploited yet: The report lists the bug’s exploitability as “unproven.”
 
The bug, found in the Lexmark Printer Software G2 Installation Package, is caused by an unquoted service-path vulnerability in the “LM__bdsvc” service. That package allows an administrator to customize the users’ installation experience, according to Lexmark.
 
The installation package in question runs on Microsoft Windows operating systems Vista (32-bit/64-bit), Server 2008 (32-bit/64-bit), Windows 7 (32-bit/64-bit), Server 2008 R2 (64-bit), Windows 8.1 (32-bit/64-bit), Windows 10 Client (32-bit/64-bit), Windows Server 2012, Server 2012 (64-bit) R2, Server 2016 (64-bit) and Server 2019 (64-bit) print and scan drivers with an enhanced GUI.
 
“By placing a specially crafted file, an attacker could exploit this vulnerability to execute arbitrary code on the system,” the advisory explained. According to ProcessChecker, a service that shows information about running processes, LM__bdsvc.exe is part of the printer communication system.
 
As of Tuesday, there was no patch or other workaround available, Aviña wrote: “No remedy available as of June 21, 2021.”
 
The advisory states that a successful attempt to exploit the bug requires the attacker “to insert an executable file into the service path undetected by the OS or some security application.” When the service or the system restarts, that executable will run with elevated privileges.
 
Lexmark told Threatpost on Tuesday that a fix is in the works. Lexmark CSO Bryan Willett said in an emailed statement that “Lexmark takes security very seriously. We are aware of this concern and are working to address the vulnerability. We welcome security researchers to report vulnerabilities directly at Lexmark Security Advisories.”

Read more: Lexmark Printers Open to Arbitrary Code-Execution Zero-Day | Threatpost