Products Affected by SHA-1 Certificate Expiration Available Options for Continuing Remote Services
Security Bulletins for Xerox Products (6)
Xerox® WorkCentre® 3655*/3655i*/58XX*/58XXi* 59XX*/59XXi*/6655**/6655i**/72XX*/72XXi* 78XX**/78XXi**/7970**/7970i** Multifunction Printer Color Multifunction Printer SPAR Release 073.xxx.237.28600
Xerox® WorkCentre® 3655/3655i/58XX/58XXi 59XX/59XXi/6655/6655i/72XX/72XXi 78XX/78XXi/7970/7970i MultiFunction Printer R17-09 SPAR Release 073.xxx.197.28500
NOTE: We are re-issuing this bulletin due to a spelling error of the name of one of the researchers. No technical content in the bulletin has changed.
Vulnerabilities exist that, if exploited, could allow remote attackers to insert arbitrary code into the device. This could occur with a specifically crafted Postscript or firmware job submitted to the device. If successful, an attacker could make unauthorized changes to the system configuration; however, customer and user passwords are not exposed.
As part of Xerox’s on-going efforts to protect customers, the ability to accept these specially crafted jobs can be disabled for the affected products listed in the bulletin. Links for the software needed are contained inside the bulletin.
Original Release September 1, 2009 An LPD protocol handling vulnerability exists in the firmware for the WorkCentre 7232/7242, the WorkCentre 7328/7335/7345/7346, and the WorkCentre 7425/7428/7435. If exploited, this vulnerability could cause a denial of service by crashing the device, although power cycling the device will recover from this attack. Customer and user passwords are not exposed.
Information Assurance for Xerox Products (1)
Statements of Volatility for Xerox Products (1)
Secure Installation and Operations Guides for Xerox Products (1)
This document has been created to detail the security settings available to customers on Xerox Multifunction devices that may not have their own specific Secure Installation and Operation document.
NOTE: Not all products will support all the security features detailed in this document.