PT-2019-13166 · Xerox+1 · Xerox Printers+1

Publicado 2019-08-13 · Atualizado 2020-03-18 · CVE-2019-13171

Positive Technologies (AI Summary)

CVSS v3.1

10

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Xerox printers versions prior to the fixed version

Description The issue is caused by an insecure handling of the register parameters in the Google Cloud Print implementation, allowing an unauthenticated attacker to execute arbitrary code on the device. This is due to the size used within a memcpy() function not being checked properly, leading to a stack-based buffer overflow. The action value is copied into a local variable, which can be exploited.

Recommendations For Xerox printers, update to a version that includes the fix for the insecure handling of register parameters in the Google Cloud Print implementation. As a temporary workaround, consider disabling the Google Cloud Print feature until a patch is available. Restrict access to the device to minimize the risk of exploitation.

Correção

Memory Corruption

Enumeração de Fraquezas

CWE-787

Identificadores relacionados

CVE-2019-13171

Produtos afetados

Google Cloud Print

Xerox Printers

Referências · 6

• https://osv.dev/vulnerability/CVE-2019-13171 · Aviso do Fabricante
• https://t.me/cybersecuritytechnologies/357 · Publicação no Telegram
• https://security.business.xerox.com · Aviso do Fabricante
• https://nccgroup.trust/us/our-research/technical-advisory-multiple-vulnerabilities-in-xerox-printers · Nota
• https://t.me/cvenotify/1655 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2019-13171 · Nota de Segurança