PT-2016-1956 · Lexmark · Lexmark Printers

Published 2016-04-22 · Updated 2019-08-28 · CVE-2016-3145

Positive Technologies (AI Summary)

CVSS v3.1

4.6

Medium

Base vector

AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Lexmark printers with firmware ATL before ATL.021.063 Lexmark printers with firmware CB before CB.021.063 Lexmark printers with firmware PP before PP.021.063 Lexmark printers with firmware YK before YK.021.063

Description The issue is related to the mishandling of Erase Printer Memory and Erase Hard Disk actions in Lexmark printers, which allows physically proximate attackers to obtain sensitive information via direct read operations on non-volatile memory. This is due to a lack of protection for service data.

Recommendations For Lexmark printers with firmware ATL before ATL.021.063, update the firmware to ATL.021.063 or later. For Lexmark printers with firmware CB before CB.021.063, update the firmware to CB.021.063 or later. For Lexmark printers with firmware PP before PP.021.063, update the firmware to PP.021.063 or later. For Lexmark printers with firmware YK before YK.021.063, update the firmware to YK.021.063 or later.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2016-01289

CVE-2016-3145

Affected Products

Lexmark Printers

References · 5

• http://support.lexmark.com/index?page=content&id=TE760 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-3145 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-3145 · Security Note
• https://bdu.fstec.ru/vul/2016-01289 · Security Note
• http://support.lexmark.com/index?page=content&id=TE760 · Note