[SA19146] Xerox CopyCentre / WorkCentre Pro Multiple Denial of Service Vulnerabilities

TITLE:
Xerox CopyCentre / WorkCentre Pro Multiple Denial of Service
Vulnerabilities

SECUNIA ADVISORY ID:
SA19146

VERIFY ADVISORY:
http://secunia.com/advisories/19146/

CRITICAL:
Moderately critical

IMPACT:
Unknown, DoS

WHERE:
>From remote

OPERATING SYSTEM:
Xerox CopyCentre
http://secunia.com/product/8595/
Xerox WorkCentre Pro
http://secunia.com/product/4553/

DESCRIPTION:
Some vulnerabilities have been reported in Xerox CopyCentre and Xerox
WorkCentre Pro, where one has an unknown impact, and others can be
exploited by malicious people to cause a DoS (Denial of Service).

1) An unspecified boundary error in the PostScript file interpreter
can be exploited to cause a buffer overflow.

Successful exploitation causes a denial of service on a vulnerable
device.

2) Two unspecified errors in the handling of PostScript files can be
exploited to cause a denial of service on a vulnerable device via a
specially crafted PostScript file.

3) An unspecified error in the built-in web server can be exploited
to cause a memory corruption.

Successful exploitation causes a denial of service on a vulnerable
device.

4) An unspecified error in the ESS / Network Controller causes an
image overwrite to fail in certain situations after a power loss.

The vulnerabilities affect the following products:

• Xerox CopyCentre C65, C75, and C90.
• Xerox WorkCentre Pro 65, 75, and 90.

SOLUTION:
Install System Software Version 1.001.02.074 or 1.001.02.716 (the
software versions can be obtained by contacting Xerox customer
support).

PROVIDED AND/OR DISCOVERED BY:
Reported by the vendor.

ORIGINAL ADVISORY:
http://www.xerox.com/downloads/usa/en/c/cert_XRX06_002.pdf

---

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/

Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.