HP Enterprise Printing Communication: Meltdown & Spectre CPU Vulnerabilities

Transcription

1 HP Inc Page Mill Rad Pal Alt, CA HP.cm Security Advisry HP Enterprise Printing Cmmunicatin: Meltdwn & Spectre CPU Vulnerabilities Jan 17 th, 2018 On January 3 rd, 2018 Ggle s Prject Zer and academic institutins annunced vulnerabilities in cmmn CPU platfrms. The vulnerabilities impact Intel x86 prcessrs and certain AMD and ARM prcessrs. The Spectre and Meltdwn vulnerabilities affect micrprcessrs utilizing speculative executin and indirect branch predictin. It may allw unauthrized disclsure f infrmatin t an attacker with lcal user access via a side-channel analysis. These vulnerabilities culd allw a malicius prcess t read memry f ther sftware prcesses. This wuld require installatin f malicius cde t perfrm a successful explit. The fllwing security features mitigate lading untrusted r tampered cde n HP devices: Digital signing f printer firmware and firmware updates Digital signing f printer slutins cde HP SureStart and Secure Bt / ROM based cde validatin Whitelisting and Cde Integrity Validatin Runtime Intrusin Detectin Run-time Cde Integrity that ensures Executable Memry is Write-Prtected Fr additinal infrmatin n these security features see the References sectin The fllwing HP print devices use x86 and ARM prcessrs that are susceptible t these vulnerabilities. One r mre f the abve security features mitigate lading untrusted r tampered cde n these devices. HP LaserJet Enterprise printers and multifunctin printers HP LaserJet Enterprise pre-futuresmart printers and multifunctin printers HP LaserJet Pr printers and multifunctin printers HP PageWide Enterprise printers and multifunctin printers Versin 1.3 Public

2 HP PageWide Pr printers and multifunctin printers HP LaserJet Managed multifunctin printers HP PageWide Managed printers and multifunctin printers HP Digital Senders and Dcument Capture Wrkstatins HP OfficeJet Pr printers HP Designjet Series printers HP PageWide XL Series printers HP HD / SD Pr Scanners HP Latex printers Fr a cmplete device listing see Appendix A. HP Sftware Slutins HP Sftware Slutins rely n their hst servers and are nt directly impacted by the CPU vulnerabilities. Patches r remediatin recmmendatins shuld be fllwed frm Micrsft and ther perating systems prviders. Recmmended Actins HP will evaluate implementatin f cde fixes frm CPU and perating system vendrs as they becme available fr HP printing device architectures. The fllwing actins further prtect against installatin f malicius cde. Nte: Nt all setting available n all devices Cnfigure lcal administratr passwrd (EWS) Disable Printer Updates Disable PJL Disk Access and Pstscript Disk Access Disable NFS Disable FTP Stay Infrmed Subscribe t HP real-time security infrmatin: All HP prducts use a cmmn centralized Security Bulletin prcess managed by HP s Prduct Security Respnse Team (PSRT). Subscribe t HP Security Bulletins by fllwing these steps: 1. G t 2. Click Get sftware and drivers. 3. Find yur prduct. 2

3 4. Scrll t the bttm f the page and under Other supprt resurces, click Sign up fr driver, supprt & security alerts. 5. Fllw the nscreen prmpts t sign up fr alerts. References Spectre Vulnerability - CVE ; CVE Meltdwn Vulnerability - CVE HPI PC Security Bulletin HP SureStart, Whitelisting and Intrusin Detectin security features HP LaserJet Pr - Embedded security features Appendix A HP LaserJet Enterprise printers and multifunctin printers HP PageWide Enterprise printers and multifunctin printers HP Digital Senders and Dcument Capture Wrkstatins HP Clr LaserJet CM4540 MFP HP LaserJet Enterprise M527 HP Clr LaserJet CP5525 HP Clr LaserJet Enterprise Flw MFP M681 HP Clr LaserJet Enterprise Flw MFP M682 HP Clr LaserJet Enterprise M552 HP Clr LaserJet Enterprise M553 HP Clr LaserJet Enterprise M651 HP Clr LaserJet Enterprise M652 HP Clr LaserJet Enterprise M653 HP Clr LaserJet Enterprise M750 HP Clr LaserJet Enterprise MFP M577 HP Clr LaserJet Enterprise MFP M681 HP Clr LaserJet Enterprise MFP M682 HP Clr LaserJet M680 HP LaserJet Enterprise 500 clr MFP M575 HP LaserJet Enterprise 500 MFP M525 HP LaserJet Enterprise 600 M601 HP LaserJet Enterprise M604 HP LaserJet Enterprise M605 HP LaserJet Enterprise M606 HP LaserJet Enterprise M607 HP LaserJet Enterprise M608 HP LaserJet Enterprise M609 HP LaserJet Enterprise M806 HP LaserJet Enterprise MFP M630 HP LaserJet Enterprise MFP M631 HP LaserJet Enterprise MFP M632 HP LaserJet Enterprise MFP M633 HP LaserJet Enterprise MFP M725 HP Digital Sender Flw 8500 fn2 Dc Capture WS HP OfficeJet Enterprise Clr Flw MFP X585 HP OfficeJet Enterprise Clr MFP X585 HP OfficeJet Enterprise Clr X555 HP LaserJet Enterprise 600 M602 HP PageWide Enterprise Clr 765 HP LaserJet Enterprise 600 M603 HP PageWide Enterprise Clr MFP 586 HP LaserJet Enterprise 700 clr MFP M775 series HP PageWide Enterprise Clr MPF 780 HP LaserJet Enterprise 700 M712 HP PageWide Enterprise Clr MPF 785 HP LaserJet Enterprise 800 clr M855 HP LaserJet Enterprise 800 clr MFP M880 HP LaserJet Enterprise Clr 500 M551 Series HP PageWide Enterprise Clr X556 HP LaserJet Enterprise Flw MFP M633 HP LaserJet Enterprise M4555 MFP 3

4 HP LaserJet Enterprise printers and multifunctin printers HP PageWide Enterprise printers and multifunctin printers HP Digital Senders and Dcument Capture Wrkstatins HP LaserJet Enterprise clr flw MFP M575 HP LaserJet Enterprise M506 HP LaserJet Enterprise flw M830z MFP HP LaserJet Enterprise flw MFP M525 HP LaserJet Enterprise Flw MFP M630 HP LaserJet Enterprise Flw MFP M631 HP Scanjet Enterprise 7000n HP Scanjet Enterprise 8500 Dc Capture WS HP ScanJet Enterprise Flw N9120 Dc Scanner HP LaserJet Enterprise Flw MFP M632 HP LaserJet Enterprise pre-futuresmart printers and multifunctin printers HP Clr LaserJet Enterprise CP4025 HP Clr LaserJet Enterprise CP4520 HP Clr LaserJet Enterprise CP4525 HP LaserJet Managed multifunctin printers HP PageWide Managed Clr Flw MFP 586 HP PageWide Managed Clr MFP E58650 HP PageWide Managed Clr MFP E77650 HP PageWide Managed Clr E75160 HP LaserJet Managed MFP E62555 HP Clr LaserJet Managed E65050 HP Clr LaserJet Managed E65060 HP Clr LaserJet Managed Flw MFP E67550 HP Clr LaserJet Managed Flw MFP E67560 HP Clr LaserJet Managed MFP E67550 HP Clr LaserJet Managed MFP E67560 HP LaserJet Managed MFP E72525 HP LaserJet Managed Flw MFP E72525 HP LaserJet Managed MFP E72530 HP LaserJet Managed Flw MFP E72530 HP LaserJet Managed MFP E72535 HP LaserJet Managed Flw MFP E72535 HP LaserJet Managed MFP E82540 HP LaserJet Managed Flw MFP E82540 HP LaserJet Managed MFP E82550 HP LaserJet Managed Flw MFP E82550 HP LaserJet Managed MFP E82560 HP LaserJet Managed Flw MFP E82560 HP PageWide Managed Clr Flw MFP E58650 HP PageWide Managed Clr Flw MFP E77660 HP PageWide Managed Clr Flw MFP E77650 HP PageWide Managed Clr E55650 HP LaserJet Managed MFP E62565 HP LaserJet Managed E60055 HP LaserJet Managed E60065 HP LaserJet Managed E60075 HP LaserJet Managed Flw MFP E62555 HP LaserJet Managed Flw MFP E62565 HP LaserJet Managed Flw MFP E62575 HP Clr LaserJet Managed MFP E77822 HP Clr LaserJet Managed Flw MFP E77822 HP Clr LaserJet Managed MFP E77825 HP Clr LaserJet Managed Flw MFP E77825 HP Clr LaserJet Managed MFP E77830 HP Clr LaserJet Managed Flw MFP E77830 HP Clr LaserJet Managed MFP E87640 HP Clr LaserJet Managed Flw MFP E87640 HP Clr LaserJet Managed MFP E87650 HP Clr LaserJet Managed Flw MFP E87650 HP Clr LaserJet Managed MFP E87660 HP Clr LaserJet Managed Flw MFP E

5 HP LaserJet Pr printers and multifunctin printers HP LaserJet M15 Printer HP Clr LaserJet Pr MFP M277dw HP LaserJet M16 Printer HP LaserJet Pr M225rdn HP LaserJet MFP M28 Printer HP LaserJet Pr M226dn HP LaserJet MFP M29 Printer HP LaserJet Pr M201 HP Clr LaserJet Pr M154 HP LaserJet Pr M202 HP Clr LaserJet Pr M254 HP Clr LaserJet Pr MFP M176 HP Clr LaserJet Pr MFP M180 HP Clr LaserJet Pr MFP M177 HP Clr LaserJet Pr MFP M181 HP LaserJet Pr MFP M125 HP Clr LaserJet Pr MFP M280 HP LaserJet Pr MFP M126 HP Clr LaserJet Pr MFP M281 HP LaserJet Pr MFP M127 HP LaserJet Pr MFP M26 HP LaserJet Pr MFP M128 HP LaserJet Pr M12 Printer HP LaserJet Pr M701 Printer HP LaserJet Pr M102 HP LaserJet Pr M706 Printer HP LaserJet Pr M104 HP Clr LaserJet Pr MFP M476 HP LaserJet Ultra M106 HP LaserJet Pr M435 MFP HP LaserJet Pr MFP M130 HP LaserJet Pr M521 MFP HP LaserJet Pr MFP M132 HP LaserJet Pr 500 clr MFP M570 HP LaserJet Ultra MFP M134 HP LaserJet Pr 400 M401 HP LaserJet Pr M203dn HP LaserJet Pr 400 MFP M425 HP LaserJet Ultra M206dn HP LaserJet Pr 200 clr MFP M276 HP LaserJet Pr MFP M227sdn HP LaserJet Pr 200 clr Printer M251 HP LaserJet Ultra MFP M230sdn HP LaserJet 100 clr MFP M175 HP LaserJet Pr M501n HP LaserJet 300 clr M351 HP Clr LaserJet Pr M452dn HP LaserJet 400 clr M451 HP Clr LaserJet Pr MFP M377dw LaserJet Pr 300 Clr MFP M375 HP Clr LaserJet Pr MFP M477fdn LaserJet Pr 400 Clr MFP M475 HP LaserJet Pr M402dn HP TpSht LaserJet Pr M275 MFP HP LaserJet Pr M403dw HP LaserJet Pr P1102 HP LaserJet Pr MFP M427dw HP LaserJet Pr CP1025 HP LaserJet Pr MFP M426fdw HP LaserJet Prfessinal M1136 MFP HP Clr LaserJet Pr M252n HP LaserJet Pr CM1415 MFP HP Clr LaserJet Pr MFP M274n HP LaserJet Pr CP1525 5

6 HP PageWide Pr printers and multifunctin printers HP PageWide Managed printers, HP OfficeJet Pr printers HP PageWide Pr 750 HP PageWide Pr 552 Printer HP PageWide Managed P75050 HP PageWide Managed P55250 HP PageWide Pr MFP 772 HP PageWide Pr 577 MFP HP PageWide Managed MFP P77740 HP PageWide MFP P57750 HP PageWide Managed MFP P77750 HP PageWide Pr 577 MFP HP PageWide Managed MFP P77760 HP OfficeJet Pr 8210 HP PageWide Pr 477 MFP HP OfficeJet Pr 8740 HP PageWide 377d MFP HP OfficeJet Pr 8730 HP PageWide Pr 452 Printer HP OfficeJet Pr 8732M HP PageWide 352d Printer HP DesignJet T730 HP PageWide Pr 452 Printer HP Designjet T830 MFP HP OfficeJet Pr 7740 Wide Frmat All-in-One HP OfficeJet Pr 7720 Wide Frmat All-in-One HP OfficeJet Pr 7730 Wide Frmat All-in-One HP Designjet Series Printers, PageWide XL Series Printers HP Latex Printers, HP HD / SD Pr Scanners HP Designjet T3500 Printer HP Latex 560 Printer HP Designjet T1700 Printer HP Latex 570 Printer HP Designjet T730 Printer HP Latex 1500 Printer HP Designjet T830 Printer HP Latex 3100 Printer PageWide XL Series Printers HP Latex 3500 Printer HP Latex 3200 Printer HP HD Pr 42 in Scanner Printer HP Latex 3600 Printer HP SD Pr 42 in Scanner Printer Rev HP Develpment Cmpany, L.P. The infrmatin cntained herein is subject t change withut ntice. The nly warranties fr HP prducts and services are set frth in the express warranty statements accmpanying such prducts and services. Nthing herein shuld be cnstrued as cnstituting an additinal warranty. HP shall nt be liable fr technical r editrial errrs r missins cntained herein. 6