WorkCentre 7655/7665/7675

Xerox Security Bulletin XRX14-008 V1.0 (PDF 1M)

Xerox Security Bulletin XRX14-008 Bash Shellshock Command Line Interpreter Vulnerability v1.0 11/10/2014

Background A vulnerability has been discovered in the Bash command shell that can allow attackers to remotely execute commands on a target system. Even systems that don’t allow remote command shell connections may still use Bash to execute commands in the Apache web server and other network-facing applications. Unix and Unix-derived systems like Linux and Mac OS X are vulnerable to these attacks since they use Bash as the default command shell.

A Bash Shellshock document addressing this vulnerability has been posted to the Xerox Security Site.

NOTE: Review the bulletin for a more complete list of devices.

Xerox Security Bulletin XRX12-005 V1.1 (PDF 103.3K)

The Xerox devices ColorQube® 9201/9202/9203, ColorQube® 9301/9302/9303, WorkCentre® 232/238/245/255/265/275, WorkCentre® 5030/5050, WorkCentre® 5135/5150, WorkCentre® 5632/5638/5645/5655/5665/5675/5687, WorkCentre® 5735/5740/5745/5755/5765/5775/5790, WorkCentre® 6400, WorkCentre® 7525/7530/7535/7545/7556, WorkCentre® 7655/7665/7675, WorkCentre® 7755/7765/7775, WorkCentre® Bookmark 40/55, WorkCentre Pro® 232/238/245/255/265/275 were shipped with certain protocols enabled that, if properly exploited, could be used to gain unauthorized access to the system. These particular protocols should not have been present in the production configuration and need to be removed from that configuration to minimize the possibility of unauthorized system access.

A software solution (patch P49) is provided for the products listed. This solution will remove from the production configuration the unwanted protocols in question so they can’t be exploited to gain unauthorized access to the system.

This solution is designed to be installed by the customer. The software solution is compressed into a 3 KB zip file and can be accessed via the link below or via the link following this bulletin announcement on the Xerox Security Site.

Software available through this link:


cert_P49v1_Patch2.zip

Xerox Security Bulletin XRX12-003 v1.1 (PDF 185.5K)

NOTE: We are re-issuing this bulletin due to a spelling error of the name of one of the researchers. No technical content in the bulletin has changed.

Vulnerabilities exist that, if exploited, could allow remote attackers to insert arbitrary code into the device. This could occur with a specifically crafted Postscript or firmware job submitted to the device. If successful, an attacker could make unauthorized changes to the system configuration; however, customer and user passwords are not exposed.

As part of Xerox’s on-going efforts to protect customers, the ability to accept these specially crafted jobs can be disabled for the affected products listed in the bulletin. Links for the software needed are contained inside the bulletin.

Xerox Security Bulletin XRX11-001 (PDF 89.7K)

A command injection vulnerability exists in the Web Server of the WorkCentre 7655/7665/7675. If exploited, the vulnerability could allow remote attackers to execute arbitrary code via carefully crafted inputs on the affected web page. Customer and user passwords are not exposed. A software solution (patch P45) is provided for the WorkCentre 7655/7665/7675.


cert_WC76xx_P45v2_Patch.zip

Xerox Security Bulletin XRX10-002 (PDF 113K)

Original Release January 22, 2010 Vulnerabilities exist in the Network Controller and Web Server of the WorkCentre 5632/5638/5645/5655/5665/5675/5687, WorkCentre 5030/5050, WorkCentre 5135/5150, WorkCentre 6400, WorkCentre 7655/7665/7675, WorkCentre 7755/7765/7775, WorkCentre/WorkCentre Pro 232/238/245/255/265/275 and ColorQube 9201/9202/9203 products. If exploited these vulnerabilities could permit an attacker to either bypass Scan to Mailbox authorization to access mailboxes stored on the device or bypass web server authorization to view device configuration settings. Customer and user passwords are not exposed.


cert_WC_CQ_P41v11_Patch.zip

Xerox Security Bulletin XRX09-002 (PDF 73.9K)

A command injection vulnerability exists in the web server of the WorkCentre/WorkCentrePro 232/238/245/255/265/275, the WorkCentre 7655/7665/7675, and the WorkCentre 5632/5638/5645/5655/5675/5687. if exploited, the vulnerability could allow remote attackers to execute arbitrary code via carefully crafted inputs on the affected web page. Customer and user passwords are not exposed.


cert_P38v1_WCP275_WC7675_WC5687_Patch.zip

Xerox Security Bulletin XRX09-003 (PDF 82.9K)

Second Release September 29, 2009 Original Release August 28, 2009 A vulnerability exists in the web servers of the WorkCentre 5030/5050, the WorkCentre 5135/5150, the WorkCentre 5632/5638/5645/5655/5665/5675/5687, the WorkCentre 7655/7665/7675, the WorkCentre 6400, and the ColorQube 9201/9202/9203. If exploited when SSL is not enabled on the device, the vulnerability could allow remote attackers to obtain unauthorized access to device configuration settings, possibly exposing customer passwords

NOTE: The original version of the P39 patch required a manual reboot after installation. This version of the patch automatically performs a re-boot upon installation.


cert_WC50xx_WC51xx_WC56xx_WC6400_WC76xx_CQ92xx_P39v5_Patch.zip

Xerox Security Bulletin XRX08-009 (PDF 104.4K)

A vulnerability exists in the WorkCentre Pro 232/238/245/255/265/275, WorkCentre 232/238/245/255/265/275, WorkCentre 7655/7665/7675, and WorkCentre 5632/5638/5645/5655/5665/5675/5687 ESS/Network Controller that, if exploited, could allow remote attackers to execute arbitrary code via specially crafted Remove Service Message Block (SMB) responses. This could occur with buffer overflows and un-validated user input in the Samba third-party code that handles file and printer sharing services for SMB clients (including Xerox MFD devices).

If successful, an attacker could make unauthorized changes to the system configuration; however, customer and user passwords are not exposed. This vulnerability affects only the printer sharing services.


cert_P36v2_WCP275_WC7675_WC5687_Patch.zip

Xerox Security Bulletin XRX08-006 (PDF 42.5K)

A vulnerability exists in the Web Services of the WorkCentre 7655/7665/7675 when attempting to access the Extensible Interface Platform feature under certain conditions. If exploited, this vulnerability could allow an attacker unauthorized access to make changes to the system configuration.


cert_P34v1_WC76xx_Patch.zip

Xerox Security Bulletin XRX08-001 (PDF 40.6K)

Vulnerabilities exist in the WorkCentre 232/238/245/255/265/275, WorkCentre Pro 232/238/245/255/265/275, and WorkCentre 7655/7665 ESS/Network Controller that, if exploited, could allow remote attackers to execute arbitrary code via specially crafted Remote Procedure Call (RPC) requests.


cert_P32v2_WCP275_WC7665_Patch.zip

Xerox Security Bulletin XRX07-001 (PDF 43.7K)

A command injection vulnerability exists in the WorkCentre 232/238/245/255/265/275, WorkCentre Pro 232/238/245/255/265/275, and WorkCentre 7655/7665 ESS/ Network Controller that, if exploited, could allow remote execution of arbitrary software, forgery of digital certificates, or initiation of Denial of Service attacks.


cert_P30_ESS_Network_Controller_Patch.zip