Executive Summary

Title Canon digital multifunction copiers FTP bounce vulnerability
Name VU#568073 First vendor Publication 2008-02-28
Vendor VU-CERT Last vendor Modification 2008-03-04
Severity (Vendor) N/A Revision M

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:N/I:P/A:P)
Cvss Base Score 6.4 Attack Range Network
Cvss Impact Score 4.9 Attack Complexity Low
Cvss Expoit Score 10 Authentication None Required
Calculate full CVSS 2.0 Vectors scores


Vulnerability Note VU#568073

Canon digital multifunction copiers FTP bounce vulnerability


Some models of Canon digital multifunction copiers are vulnerable to the FTP bounce attack.

I. Description

From the Problems With The FTP PORT Commanddocument:

    The FTP Bounce Attack

    To conform with the FTP protocol, the PORT command has the originating machine specify an arbitrary destination machine and port for the data connection. However, this behavior also means that an attacker can open a connection to a port of the attacker's choosing on a machine that may not be the originating client.

Some Canon digital multifunction printers contain an FTP server that is vulnerable to the FTP bounce attack.

II. Impact

A remote, unauthenticated attacker may be able to conduct port scans or send arbitrary (TCP) traffic to other hosts.

III. Solution

We are currently unaware of a practical solution to this problem.

The following workarounds may mitigate this vulnerability.

Disable the affected FTP server
Administrators and users should either turn off the vulnerable FTP server or disable anonymous access. See the Steps to take to clear vulnerabilitysection of the Canon Web Advisory: Digital multifunction printer vulnerability for more information.

Use host based firewalls
Administrators and users can use host-based firewalls to prevent affected printers and other devices from creating connections to arbitrary TCP ports.

Systems Affected

VendorStatusDate Updated




Thanks to Canon for information that was used in this report. Canon credits Nate Johnson and the Indiana University for reporting this vulnerability.

This document was written by Ryan Giobbi.

Other Information

Date Public02/28/2008
Date First Published02/28/2008 02:46:21 PM
Date Last Updated03/04/2008
CERT Advisory 
CVE NameCVE-2008-0303
US-CERT Technical Alerts 
Document Revision11

Original Source

Url : http://www.kb.cert.org/vuls/id/568073

CPE : Common Platform Enumeration

Application 3
Application 1
Application 57
Application 1
Application 1
Application 1
Application 1
Application 1
Application 1
Application 1
Application 1
Application 1

Open Source Vulnerability Database (OSVDB)

Id Description
43118 Canon Multiple Printers PORT Command FTP Proxy Bounce