PT-2019-13166 · Xerox+1 · Xerox Printers+1

Published 2019-08-13 · Updated 2020-03-18 · CVE-2019-13171

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Xerox printers versions prior to the fixed version

Description The issue is caused by an insecure handling of the register parameters in the Google Cloud Print implementation, allowing an unauthenticated attacker to execute arbitrary code on the device. This is due to the size used within a memcpy() function not being checked properly, leading to a stack-based buffer overflow. The action value is copied into a local variable, which can be exploited.

Recommendations For Xerox printers, update to a version that includes the fix for the insecure handling of register parameters in the Google Cloud Print implementation. As a temporary workaround, consider disabling the Google Cloud Print feature until a patch is available. Restrict access to the device to minimize the risk of exploitation.

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2019-13171

Affected Products

Google Cloud Print

Xerox Printers

References · 6

• https://osv.dev/vulnerability/CVE-2019-13171 · Vendor Advisory
• https://security.business.xerox.com · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-13171 · Security Note
• https://t.me/cybersecuritytechnologies/357 · Telegram Post
• https://nccgroup.trust/us/our-research/technical-advisory-multiple-vulnerabilities-in-xerox-printers · Note
• https://t.me/cvenotify/1655 · Telegram Post