Xerox WorkCentre Authorization Bypass Vulnerabilities (XRX10-002)

This script is Copyright (C) 2010-2017 Tenable Network Security, Inc.


Synopsis :

The remote multi-function device allows an attacker to gain access to
the device without authorization.

Description :

According to its model number and software version, the remote host
is a Xerox WorkCentre device that is affected by two authorization
bypass vulnerabilities :

- The web interface reportedly includes a script named
'YoUgoT_It.php' that will calculate a checksum for a
specified folder name that will allow an attacker to
access password-protected scan folders.

- The web interface reportedly contains multiple scripts
that fail to call 'die()' or 'exit()' after issuing a
redirect to a login page when a visitor is not logged
in and before running the rest of the script. It also
contains scripts that are normally referenced within
framesets that require credentials even though the
scripts themselves do not when called directly.

See also :

http://www.nessus.org/u?eef14f03
http://www.securityfocus.com/archive/1/509684/30/0/threaded
http://www.xerox.com/downloads/usa/en/c/cert_XRX10-002_v1.0.pdf

Solution :

Apply the P41v7 patch as described in the Xerox security bulletin
referenced above.

Risk factor :

High / CVSS Base Score : 7.8
(CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:N)
CVSS Temporal Score : 6.8
(CVSS2#E:ND/RL:OF/RC:C)
Public Exploit Available : false

Family: Misc.

Nessus Plugin ID: 44944 ()

Bugtraq ID: 37921

CVE ID: CVE-2010-0548

Ready to Amp Up Your Nessus Experience?

Get Nessus Professional to scan unlimited IPs, run compliance checks & more

Buy Nessus Professional Now