OfficeJet 7500 openssl Qualys vulnerability

[anreeves]

I have an OfficeJet 7500 that is on our network and our most recent Qualys scan show it has OpenSSL Multiple Remote Security Vulnerabilities.

[anreeves]

I can now confirm that this is not a fluke, it has shown up on multiple scans and we had several others of the same model that our network security area had not assisnged as ours in Qualys. They have been now and also are flagged. It is not reported as Heartbleed, which I believe would be a full level 5 anyways. This is reported as a level 4.

[anreeves]

OpenSSL has fixed the security issue on their end. HP just needs to add it to the firmware. While I have not seen any of our other HP network printers get flagged and I have not heard either here on campus or elsewhere about anyone with similar issues. Despite this I am conviced this is not a isolated incident. I do have one Xerox that got flagged as well. I did have some web servers that also were flagged, but of course I was able to apply the OpenSSL patch directly.

[tam-web]

There are several man in the middle attacks that can be identified via scanners.  Do you have the specific scan ID  or CVE for the vulnerability?    

[anreeves]

OpenSSL Multiple Remote Security Vulnerabilities port 443/tcp over SSL

  QID: 38602 Category: General remote services CVE ID: CVE-2014-0224 CVE-2014-0221 CVE-2014-0195 CVE-2014-0198 CVE-2010-5298 CVE-2014-3470 CVE-2014-0076 Vendor Reference OpenSSL Security Advisory [05 Jun 2014]

[tam-web]

HP Download Link

http://h10025.www1.hp.com/ewfrf/wc/softwareCategory?os=4063&lc=en&cc=us&dlc=en&sw_lang=&product=4083...

Please check on the HP software download site for updates. 

[anreeves]

Thank you

[anreeves]

I still have not seen an updated firmware.

[anreeves]

Now Qualys is also showing a level 5 potential of  TLS Protocol Session Renegotiation Security Vulnerability

CVE-2009-3555

[anreeves]

If we could just turn off the config web page that would be fine.