----------------------------------------------------------------------

Did you know? Our assessment and impact rating along with detailed
information such as exploit code availability, or if an updated patch
is released by the vendor, is not part of this mailing-list?
        
Click here to learn more about our commercial solutions:
http://secunia.com/advisories/business_solutions/
        
Click here to trial our solutions:
http://secunia.com/advisories/try_vi/

----------------------------------------------------------------------

TITLE:
HP Products Embedded Web Server Cross-Site Request Forgery

SECUNIA ADVISORY ID:
SA34343

VERIFY ADVISORY:
http://secunia.com/advisories/34343/

DESCRIPTION:
A vulnerability has been reported in various HP products, which can
be exploited by malicious people to conduct cross-site request
forgery attacks.

The embedded web server allows users to perform certain actions via
HTTP requests without performing any validity checks to verify the
requests. This can be exploited to e.g. change certain configuration
settings when a logged in user to visits a malicious web page.

The vulnerability is reported in HP LaserJet M1522n MFP and HP Color
LaserJet 2605dtn. Other HP LaserJet and HP Edgeline printers, and HP
Digital Senders products are reportedly also affected.

SOLUTION:
Do not browse untrusted web sites while being logged in to the
management interface.

PROVIDED AND/OR DISCOVERED BY:
Henri Lindberg, Louhi Networks

CHANGELOG:
HP (HPSN-2009-001):
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01684566

Louhi Networks:
http://www.louhinetworks.fi/advisory/HP_20090317.txt

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/advisories/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------