How to remediate – Do not scan printers

1. Introduction

The vulnerability “Do not scan printers” means Nessus will skip scanning network printers and multi-function devices because they often crash or misbehave when scanned. This matters to businesses as it could leave these devices unpatched and vulnerable, potentially exposing the network to attack. Confidentiality, integrity, and availability may be impacted if a printer is compromised.

2. Technical Explanation

The remote host is identified as a fragile device – typically a printer or similar networked appliance. Scanning these devices can cause them to become unresponsive or exhibit unexpected behaviour. Nessus prevents this by marking the host as ‘Dead’ and excluding it from scans. To exploit, an attacker would need to find a vulnerability on the un-scanned printer.

• Root cause: The device is sensitive to network scanning techniques.
• Exploit mechanism: An attacker could attempt to exploit known vulnerabilities on the printer without detection due to lack of scanning.
• Scope: Network printers, multi-function devices and other fragile devices are affected.

3. Detection and Assessment

To confirm if a system is affected, check whether Nessus has marked it as ‘Dead’. A thorough method involves reviewing the scan configuration to see if printer scanning is disabled.

• Quick checks: Review Nessus scan results for hosts marked as ‘Dead’.
• Scanning: Nessus identifies these devices automatically during a standard scan.
• Logs and evidence: Check Nessus logs for messages indicating the host was identified as fragile and excluded from scanning.

4. Solution / Remediation Steps

To fix this issue, enable printer scanning in the Nessus advanced settings if you are not concerned about potential device instability. Only do this if you can accept the risk of a device crash or misbehaviour.

4.1 Preparation

• Backups are not required for this change. No services need to be stopped.
• Dependencies: Nessus must be running and accessible. Roll back by disabling printer scanning again if issues occur.
• Change window needs may apply depending on your organisation’s policies. Approval from the IT security team might be needed.

4.2 Implementation

1. Step 1: Log in to the Nessus web interface as an administrator.
2. Step 2: Go to Settings > Advanced.
3. Step 3: Under ‘Do not scan fragile devices’, enable the ‘Scan Network Printers’ setting.
4. Step 4: Save the changes and re-run your scans.

4.3 Config or Code Example

Before

Scan Network Printers: Disabled

After

Scan Network Printers: Enabled

4.4 Security Practices Relevant to This Vulnerability

Regular vulnerability scanning is a key practice for identifying and addressing potential security weaknesses in all devices on the network, including printers. Patch management ensures that known vulnerabilities are addressed promptly.

• Practice 1: Regular vulnerability scanning helps identify unpatched devices.
• Practice 2: Patch management reduces the attack surface by fixing known flaws.

4.5 Automation (Optional)

N/A – This setting is configured through the Nessus web interface and does not lend itself to easy automation.

5. Verification / Validation

• Post-fix check: Review Nessus scan results to ensure printers are included in the scan output.
• Re-test: Run a new scan and confirm that printers are scanned, not marked as ‘Dead’.
• Monitoring: Check Nessus logs for any errors related to printer scans.

6. Preventive Measures and Monitoring

For example, regularly update your security baselines to include the latest vulnerability information for network devices. Implement a patch management process that includes printers and other multi-function devices.

• Baselines: Update security baselines to reflect current printer vulnerabilities.
• Pipelines: Integrate vulnerability scanning into CI/CD pipelines where applicable.
• Asset and patch process: Review printer firmware and software regularly for updates.

7. Risks, Side Effects, and Roll Back

Enabling printer scanning may cause some printers to become unresponsive or crash. If this occurs, disable the ‘Scan Network Printers’ setting immediately.

• Risk or side effect 1: Printer crashes or misbehaviour. Mitigation: Disable scanner if issues occur.
• Roll back: Log in to Nessus, go to Settings > Advanced, and disable the ‘Scan Network Printers’ setting. Save changes and re-run scans.

8. References and Resources

• Vendor advisory or bulletin: N/A – This is a Nessus detection setting, not a vendor vulnerability.
• NVD or CVE entry: N/A – No specific CVE associated with this Nessus detection.
• Product or platform documentation relevant to the fix: Tenable Documentation on Advanced Settings.