Xerox WorkCentre 4260 / 4265 Multiple Vulnerabilities (XRX15AV) (FREAK) (Logjam)
Medium Nessus Plugin ID 87326
SynopsisThe remote multi-function device is affected by multiple vulnerabilities.
DescriptionAccording to its model number and software version, the remote Xerox WorkCentre 4260 / 4265 device is affected by multiple vulnerabilities :
- A security feature bypass vulnerability, known as FREAK (Factoring attack on RSA-EXPORT Keys), exists due to the support of weak EXPORT_RSA cipher suites with keys less than or equal to 512 bits. A man-in-the-middle attacker may be able to downgrade the SSL/TLS connection to use EXPORT_RSA cipher suites which can be factored in a short amount of time, allowing the attacker to intercept and decrypt the traffic. (CVE-2015-0204)
- A man-in-the-middle vulnerability, known as Logjam, exists due to a flaw in the SSL/TLS protocol. A remote attacker can exploit this flaw to downgrade connections using ephemeral Diffie-Hellman key exchange to 512-bit export-grade cryptography. (CVE-2015-4000)
- A TCP connection spoofing vulnerability exists due to weak TCP initial sequence number (ISN) generation. A man-in-the-middle attacker can exploit this to spoof TCP connections or cause a denial of service.
Note that the FREAK (CVE-2015-0204) vulnerability on WorkCentre 4260 was fixed in a prior release.
SolutionApply the appropriate cumulative update as described in the Xerox security bulletin in the referenced URL.