Xerox Multiple Copier/Printer Models Web Server Unspecified HTML Injection Vulnerability

Bugtraq ID:	29690
Class:	Input Validation Error
CVE:	CVE-2008-2743
Remote:	Yes
Local:	No
Published:	Jun 12 2008 12:00AM
Updated:	May 07 2015 05:28PM
Credit:	Finland's Louhi Networks
Vulnerable:	Xerox 4595 Copier/Printer 0 Xerox 4590 Copier/Printer 0 Xerox 4110 Copier/Printer 0
Not Vulnerable:

Xerox Multiple Copier/Printer Models Web Server Unspecified HTML Injection Vulnerability

The webserver in multiple Xerox copier/printer models is prone to an unspecified HTML-injection vulnerability because it fails to properly sanitize user-supplied input.

Attacker-supplied HTML and script code would execute in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user; other attacks are also possible.

The following Xerox copier/printer models are affected:

Xerox 4110
Xerox 4590
Xerox 4595

Xerox Multiple Copier/Printer Models Web Server Unspecified HTML Injection Vulnerability

Attackers would likely exploit this issue via a browser.

Xerox Multiple Copier/Printer Models Web Server Unspecified HTML Injection Vulnerability

Solution:
The vendor has released updates. Please see the references for more information.


Xerox 4590 Copier/Printer 0

• Xerox XC110_080519_PS-1.EXE
  http://www.xerox.com/downloads/usa/en/c/XC110_080519_PS-1.EXE

Xerox 4595 Copier/Printer 0

• Xerox XC110_080519_PS-1.EXE
  http://www.xerox.com/downloads/usa/en/c/XC110_080519_PS-1.EXE

Xerox 4110 Copier/Printer 0

• Xerox XC110_080519_PS-1.EXE
  http://www.xerox.com/downloads/usa/en/c/XC110_080519_PS-1.EXE

Xerox Multiple Copier/Printer Models Web Server Unspecified HTML Injection Vulnerability

References:

• Xerox Homepage (Xerox)
  
• Xerox Security Bulletin XRX08-007 (Xerox)