Xerox WorkCentre Web Server Unspecified Command Injection (XRX09-002)
2009-05-15T00:00:00
ID XEROX_XRX09_002.NASL Type nessus Reporter This script is Copyright (C) 2009-2018 Tenable Network Security, Inc. Modified 2021-02-02T00:00:00
Description
According to its model number and software version, the remote host
is a Xerox WorkCentre device that reportedly has an as-yet unspecified
command injection vulnerability in its web server. A remote attacker
may be able to leverage this issue to execute arbitrary code via
carefully crafted inputs on an affected web page.
#
# (C) Tenable Network Security, Inc.
#
include("compat.inc");
if (description)
{
script_id(38790);
script_version("1.13");
script_cvs_date("Date: 2018/11/15 20:50:24");
script_cve_id("CVE-2009-1656");
script_bugtraq_id(34984);
script_xref(name:"Secunia", value:"35101");
script_name(english:"Xerox WorkCentre Web Server Unspecified Command Injection (XRX09-002)");
script_summary(english:"Checks Net Controller Software version of Xerox WorkCentre devices");
script_set_attribute(
attribute:"synopsis",
value:
"The remote multi-function device is affected by a command injection
vulnerability."
);
script_set_attribute(
attribute:"description",
value:
"According to its model number and software version, the remote host
is a Xerox WorkCentre device that reportedly has an as-yet unspecified
command injection vulnerability in its web server. A remote attacker
may be able to leverage this issue to execute arbitrary code via
carefully crafted inputs on an affected web page."
);
script_set_attribute(attribute:"see_also", value:"https://www.xerox.com/downloads/usa/en/c/cert_XRX09-02_v1.0.pdf");
script_set_attribute(
attribute:"solution",
value:
"Apply the P38 patch as described in the Xerox security bulletin
referenced in the included URL."
);
script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
script_set_attribute(attribute:"exploit_available", value:"false");
script_set_attribute(attribute:"vuln_publication_date", value:"2009/05/15");
script_set_attribute(attribute:"patch_publication_date", value:"2009/05/15");
script_set_attribute(attribute:"plugin_publication_date", value:"2009/05/15");
script_set_attribute(attribute:"plugin_type", value:"remote");
script_set_attribute(attribute:"cpe", value:"cpe:/h:xerox:workcentre");
script_end_attributes();
script_category(ACT_GATHER_INFO);
script_family(english:"Misc.");
script_copyright(english:"This script is Copyright (C) 2009-2018 Tenable Network Security, Inc.");
script_dependencies("xerox_workcentre_detect.nasl");
script_require_keys("www/xerox_workcentre");
exit(0);
}
include("audit.inc");
include("global_settings.inc");
include("misc_func.inc");
# This function returns TRUE if the version string ver lies in
# the range [low, high].
function ver_inrange(ver, low, high)
{
local_var ver_parts, low_parts, high_parts, i, p, low_p, high_p;
if (isnull(ver) || isnull(low) || isnull(high)) return FALSE;
# Split levels into parts.
ver_parts = split(ver, sep:".", keep:0);
low_parts = split(low, sep:".", keep:0);
high_parts = split(high, sep:".", keep:0);
# Compare each part.
i = 0;
while (ver_parts[i] != NULL)
{
p = int(ver_parts[i]);
low_p = int(low_parts[i]);
if (low_p == NULL) low_p = 0;
high_p = int(high_parts[i]);
if (high_p == NULL) high_p = 0;
if (p > low_p && p < high_p) return TRUE;
if (p < low_p || p > high_p) return FALSE;
++i;
}
return TRUE;
}
# Check whether the device is vulnerable.
if (get_kb_item("www/xerox_workcentre"))
{
model = get_kb_item_or_exit("www/xerox_workcentre/model");
ssw = get_kb_item_or_exit("www/xerox_workcentre/ssw");
if (ssw && "." >< ssw) ssw = strstr(ssw, ".") - ".";
ess = get_kb_item_or_exit("www/xerox_workcentre/ess");
# No need to check further if ESS has ".P38" since that
# indicates the patch has already been applied.
if (ess && ess =~ "\.P38") audit(AUDIT_HOST_NOT, "affected");
# Test model number and software version against those in Xerox's security bulletin.
if (
(
# nb: models 232/238/245/255/265/275 with SSW in [*.27.24.000, *.60.22.050).
model =~ "^(Pro )?2(3[28]|[4-7]5)($|[^0-9])" &&
# nb: the leading part of the System SW has already been removed.
ver_inrange(ver:ssw, low:"27.24.000", high:"60.22.049")
) ||
(
# nb: models 7655/7665/7675 with ESS in [040.032.000, 040.033.53110).
model =~ "^76[5-7]5($|[^0-9])" &&
ver_inrange(ver:ess, low:"040.032.0", high:"040.033.53109")
) ||
(
# nb: models 5632/5638/5645/5655/5665/5675/5687 with ESS in [050.060.50730, 050.060.50980].
model =~ "^56(32|38|[4-7]5|87)($|[^0-9])" &&
ver_inrange(ver:ess, low:"050.060.50730", high:"050.060.50980")
)
)
security_hole(0);
exit(0);
}
audit(AUDIT_HOST_NOT, "affected");
{"id": "XEROX_XRX09_002.NASL", "bulletinFamily": "scanner", "title": "Xerox WorkCentre Web Server Unspecified Command Injection (XRX09-002)", "description": "According to its model number and software version, the remote host\nis a Xerox WorkCentre device that reportedly has an as-yet unspecified\ncommand injection vulnerability in its web server. A remote attacker\nmay be able to leverage this issue to execute arbitrary code via\ncarefully crafted inputs on an affected web page.", "published": "2009-05-15T00:00:00", "modified": "2021-02-02T00:00:00", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}, "href": "https://www.tenable.com/plugins/nessus/38790", "reporter": "This script is Copyright (C) 2009-2018 Tenable Network Security, Inc.", "references": ["https://www.xerox.com/downloads/usa/en/c/cert_XRX09-02_v1.0.pdf"], "cvelist": ["CVE-2009-1656"], "type": "nessus", "lastseen": "2021-02-01T07:40:22", "edition": 26, "viewCount": 6, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2009-1656"]}], "modified": "2021-02-01T07:40:22", "rev": 2}, "score": {"value": 7.9, "vector": "NONE", "modified": "2021-02-01T07:40:22", "rev": 2}, "vulnersScore": 7.9}, "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(38790);\n script_version(\"1.13\");\n script_cvs_date(\"Date: 2018/11/15 20:50:24\");\n\n script_cve_id(\"CVE-2009-1656\");\n script_bugtraq_id(34984);\n script_xref(name:\"Secunia\", value:\"35101\");\n\n script_name(english:\"Xerox WorkCentre Web Server Unspecified Command Injection (XRX09-002)\");\n script_summary(english:\"Checks Net Controller Software version of Xerox WorkCentre devices\");\n\n script_set_attribute(\n attribute:\"synopsis\",\n value:\n\"The remote multi-function device is affected by a command injection\nvulnerability.\"\n );\n script_set_attribute(\n attribute:\"description\",\n value:\n\"According to its model number and software version, the remote host\nis a Xerox WorkCentre device that reportedly has an as-yet unspecified\ncommand injection vulnerability in its web server. A remote attacker\nmay be able to leverage this issue to execute arbitrary code via\ncarefully crafted inputs on an affected web page.\"\n );\n script_set_attribute(attribute:\"see_also\", value:\"https://www.xerox.com/downloads/usa/en/c/cert_XRX09-02_v1.0.pdf\");\n script_set_attribute(\n attribute:\"solution\",\n value:\n\"Apply the P38 patch as described in the Xerox security bulletin\nreferenced in the included URL.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2009/05/15\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2009/05/15\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2009/05/15\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"remote\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/h:xerox:workcentre\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Misc.\");\n\n script_copyright(english:\"This script is Copyright (C) 2009-2018 Tenable Network Security, Inc.\");\n\n script_dependencies(\"xerox_workcentre_detect.nasl\");\n script_require_keys(\"www/xerox_workcentre\");\n\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"misc_func.inc\");\n\n# This function returns TRUE if the version string ver lies in\n# the range [low, high].\nfunction ver_inrange(ver, low, high)\n{\n local_var ver_parts, low_parts, high_parts, i, p, low_p, high_p;\n\n if (isnull(ver) || isnull(low) || isnull(high)) return FALSE;\n\n # Split levels into parts.\n ver_parts = split(ver, sep:\".\", keep:0);\n low_parts = split(low, sep:\".\", keep:0);\n high_parts = split(high, sep:\".\", keep:0);\n\n # Compare each part.\n i = 0;\n while (ver_parts[i] != NULL)\n {\n p = int(ver_parts[i]);\n low_p = int(low_parts[i]);\n if (low_p == NULL) low_p = 0;\n high_p = int(high_parts[i]);\n if (high_p == NULL) high_p = 0;\n\n if (p > low_p && p < high_p) return TRUE;\n if (p < low_p || p > high_p) return FALSE;\n ++i;\n }\n return TRUE;\n}\n\n# Check whether the device is vulnerable.\nif (get_kb_item(\"www/xerox_workcentre\"))\n{\n model = get_kb_item_or_exit(\"www/xerox_workcentre/model\");\n ssw = get_kb_item_or_exit(\"www/xerox_workcentre/ssw\");\n if (ssw && \".\" >< ssw) ssw = strstr(ssw, \".\") - \".\";\n ess = get_kb_item_or_exit(\"www/xerox_workcentre/ess\");\n\n # No need to check further if ESS has \".P38\" since that\n # indicates the patch has already been applied.\n if (ess && ess =~ \"\\.P38\") audit(AUDIT_HOST_NOT, \"affected\");\n\n # Test model number and software version against those in Xerox's security bulletin.\n if (\n (\n # nb: models 232/238/245/255/265/275 with SSW in [*.27.24.000, *.60.22.050).\n model =~ \"^(Pro )?2(3[28]|[4-7]5)($|[^0-9])\" &&\n # nb: the leading part of the System SW has already been removed.\n ver_inrange(ver:ssw, low:\"27.24.000\", high:\"60.22.049\")\n ) ||\n (\n # nb: models 7655/7665/7675 with ESS in [040.032.000, 040.033.53110).\n model =~ \"^76[5-7]5($|[^0-9])\" &&\n ver_inrange(ver:ess, low:\"040.032.0\", high:\"040.033.53109\")\n ) ||\n (\n # nb: models 5632/5638/5645/5655/5665/5675/5687 with ESS in [050.060.50730, 050.060.50980].\n model =~ \"^56(32|38|[4-7]5|87)($|[^0-9])\" &&\n ver_inrange(ver:ess, low:\"050.060.50730\", high:\"050.060.50980\")\n )\n )\n security_hole(0);\n exit(0);\n}\naudit(AUDIT_HOST_NOT, \"affected\");\n", "naslFamily": "Misc.", "pluginID": "38790", "cpe": ["cpe:/h:xerox:workcentre"], "scheme": null}