NOTE: We are re-issuing this bulletin due to a spelling error of the name of one of the researchers. No technical content in the bulletin has changed.
Vulnerabilities exist that, if exploited, could allow remote attackers to insert arbitrary code into the device. This could occur with a specifically crafted Postscript or firmware job submitted to the device. If successful, an attacker could make unauthorized changes to the system configuration; however, customer and user passwords are not exposed.
As part of Xerox’s on-going efforts to protect customers, the ability to accept these specially crafted jobs can be disabled for the affected products listed in the bulletin. Links for the software needed are contained inside the bulletin.
A command injection vulnerability exists in the ESS/ Network Controller and MicroServer Web Server. If exploited this vulnerability could allow remote execution of arbitrary software.
This bulletin has been rescinded and is no longer valid. Software Download permanently unavailable
Vulnerabilities in the Document Centre 240/255/265, Document Centre 420/425/428/430/432/440, Document Centre 460/470/480/490, and Document Centre 535/545/555 Xerox MicroServer Web Server could potentially permit unauthorized access.
Vulnerability in the Document Centre 420/425/426/430/432/440, Document Centre 470/480/490, and Document Centre 535/545/555 Xerox MicroServer Web Server could cause a denial of service.
Vulnerability in the Document Centre 220/230, Document Centre 240/255/265, Document Centre 332/340, Document Centre 420/425/426/430/432/440, Document Centre 460/470/480/490 and Document Centre 535/545/555 ESS/ Network Controller could potentially permit unauthorized access.
The Document Centre 220/230, Document Centre 240/255/265, Document Centre 332/340, Document Centre 420/425/432/440, Document Centre 460/470/480/490, Document Centre 535/545/555, WorkCentre M35/M45/M55, WorkCentre Pro Color 32/40, contain a Xerox MicroServer Web Server Vulnerability.