Xerox WorkCentre Webserver Unspecified Remote Command Execution Vulnerability

Bugtraq ID:	46160
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Feb 04 2011 12:00AM
Updated:	Feb 04 2011 12:00AM
Credit:	thelightcosine
Vulnerable:	Xerox WorkCentre 7675 0 Xerox WorkCentre 7665 0 Xerox WorkCentre 7655 0
Not Vulnerable:

Xerox WorkCentre Webserver Unspecified Remote Command Execution Vulnerability

Xerox WorkCentre is prone to an unspecified remote command-execution vulnerability because it fails to sanitize user-supplied input. This issue occurs in the webserver.

An attacker can exploit this issue to execute arbitrary commands with the privileges of the webserver, which may aid in further attacks.

Technical details are currently unavailable. We will update this BID as soon as more information emerges.

The following Xerox products are affected:

WorkCentre 7655
WorkCentre 7665
WorkCentre 7675

Xerox WorkCentre Webserver Unspecified Remote Command Execution Vulnerability

Attackers would likely exploit this issue via a browser.

Xerox WorkCentre Webserver Unspecified Remote Command Execution Vulnerability

Solution:
The vendor has released an advisory and updates. Please see the references for details.

Xerox WorkCentre Webserver Unspecified Remote Command Execution Vulnerability

References:

• Xerox Homepage (Xerox)
  
• Xerox Security Bulletin XRX11-001 Software update to address Command Injection V (Xerox)