==================================================================== CERT-Renater Note d'Information No. 2012/VULN135 ____________________________________________________________________ DATE : 16/03/2012 HARDWARE PLATFORM(S): Différents produits Xerox OPERATING SYSTEM(S) : NA ====================================================================== http://www.xerox.com/download/security/security-bulletin/1284332-2ddc5-4baa79b70ac40/cert_XRX12-003_v1.1.pdf ______________________________________________________________________ Xerox Security Bulletin XRX12-003 Address Postscript and DLM Vulnerabilities v1.1 03/07/12 Background Vulnerabilities exist that, if exploited, could allow remote attackers to insert arbitrary code into the device. This could occur with a specifically crafted Postscript or firmware job submitted to the device. If successful, an attacker could make unauthorized changes to the system configuration; however, customer and user passwords are not exposed. As part of Xerox’s on-going efforts to protect customers, the ability to accept these specially crafted jobs can be disabled for the network-connected versions of affected products listed below as follows: 1. Software upgrades can be disabled at the device by an administrator: • ColorQube 9201/9202/9203 • ColorQube 9301/9302/9303 • Phaser 3635MFP • Phaser 4600/4620 • Phaser 6700 • Phaser 7800 • WorkCentre 232/238/245/255/265/275 • WorkCentre 4150 • WorkCentre 4250 • WorkCentre 4260 • WorkCentre 5030/5050 • WorkCentre 5135/5150 • WorkCentre 5222/5225/5230 • WorkCentre 5325/5330/5335 • WorkCentre 5632/5638/5645/5655/5665/5675 • WorkCentre 5735/5740/5745/5755/5765/5775/5790 • WorkCentre 6400 • WorkCentre 7120/7125 • WorkCentre 7132 • WorkCentre 7228/7235/7245 • WorkCentre 7232/7242 • WorkCentre 7328/7335/7345/7346 • WorkCentre 7425/7428/7435 • WorkCentre 7525/7530/7535/7545/7556 • WorkCentre 7655/7665/7675 • WorkCentre 7755/7765/7775 • WorkCentre Bookmark 40/55 • WorkCentre M35/M45/M55 • WorkCentre M165/M175 • WorkCentre Pro 32/40 Color • WorkCentre Pro 35/45/55 • WorkCentre Pro 65/75/90 • WorkCentre Pro 165/175 • WorkCentre Pro 232/238/245/255/265/275 • WorkCentre Pro C2128/C2636/C3545 • Xerox Color 550/560 Notes: a. Disabling the software upgrade feature also disables the ability of the device to accept clone files. b. Many of those products listed above already support the ability to disable the Software Upgrade feature through the device web interface. This can be done without requiring loading of any additional software. 2. The device configuration security settings can be set by an administrator to deny access to configuration changes: • ColorQube 8570/8870 • Phaser 4510 • Phaser 5550 • Phaser 6350 • Phaser 6360 • Phaser 7400 • Phaser 7500 • Phaser 7760 • Phaser 8550 • Phaser 8560 • Phaser 8560MFP • Phaser 8860 • Phaser 8860MFP 3. A software patch will be available to add the ability of an administrator to disable software: • Phaser 3160N • Phaser 3250 • Phaser 3300MFP • Phaser 3435 • Phaser 3600 • WorkCentre 3210/3220 • WorkCentre 3550 • WorkCentre 4118 • WorkCentre M20/M20i 4. No action is needed: • Document Centre 430 • Phaser 6115MFP • Phaser 6121MFP • WorkCentre M118/M118i 5. The following products are under review: • Phaser 6010 • Phaser 6125 • Phaser 6128MFP • Phaser 6130 • Phaser 6140 • Phaser 6180 • Phaser 6180MFP • Phaser 6280 • Phaser 6500 • WorkCentre 3045N/I • WorkCentre 5020 • WorkCentre 6015N/I • WorkCentre 6505 • WorkCentre Pro 123/128/133 • Xerox 4127/4112 • Xerox 4590/4595 Please follow the applicable procedures below to protect your product from this possible attack through the network. The solution for this vulnerability is classified as Critical. Acknowledgment Xerox wishes to thank both Deral Heiland (www.foofus.net) and Andrei Costin (www.andreicostin.com) for initially notifying us of these vulnerabilities. Disclaimer The information provided in this Xerox Product Response is provided "as is" without warranty of any kind. Xerox Corporation disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Xerox Corporation be liable for any damages whatsoever resulting from user's use or disregard of the information provided in this Xerox Product Response including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Xerox Corporation has been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential damages so the foregoing limitation may not apply. ©2012 Xerox Corporation. All rights reserved. Contents of this publication may not be reproduced in any form without permission of Xerox Corporation. XEROX®, XEROX and Design®, CentreWare®, Phaser®, ColorQube®, Document Centre®, WorkCentre®, and WorkCentre Pro® are trademarks of Xerox Corporation in the United States and/or other countries. Adobe® and PostScript® are registered trademarks or trademarks of Adobe Systems, Incorporated. All other trademarks are the property of their respective manufacturers. The information in this bulletin is subject to change without notice. ====================================================================== ========================================================= Les serveurs de référence du CERT-Renater https://services.renater.fr/ssi/ ========================================================= + CERT-RENATER | tel : 01-53-94-20-44 + + 23 - 25 Rue Daviel | fax : 01-53-94-20-41 + + 75013 Paris | email: certsvp@renater.fr + =========================================================