CVE-2019-13171

Some Xerox printers (such as the Phaser 3320 V53.006.16.000) were affected by one or more stack-based buffer overflow vulnerabilities in the Google Cloud Print implementation that would allow an unauthenticated attacker to execute arbitrary code on the device. This was caused by an insecure handling of the register parameters, because the size used within a memcpy() function, which copied the action value into a local variable, was not checked properly.

CVSS v3 9.8 CRITICAL
CVSS v2.0 10.0 HIGH

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

10.0^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:C/I:C/A:C

Exploitability : 10.0 / Impact : 10.0

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
https://security.business.xerox.com/	Vendor Advisory
https://www.nccgroup.trust/us/our-research/technical-advisory-multiple-vulnerabilities-in-xerox-printers/	Third Party Advisory
https://security.business.xerox.com/	Vendor Advisory
https://www.nccgroup.trust/us/our-research/technical-advisory-multiple-vulnerabilities-in-xerox-printers/	Third Party Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:xerox:phaser_3320_firmware:v53.006.16.000:*:*:*:*:*:*:*

cpe:2.3:h:xerox:phaser_3320:-:*:*:*:*:*:*:*

History

21 Nov 2024, 04:24

Type	Values Removed	Values Added
References	~~() https://security.business.xerox.com/ - Vendor Advisory~~	() https://security.business.xerox.com/ - Vendor Advisory
References	~~() https://www.nccgroup.trust/us/our-research/technical-advisory-multiple-vulnerabilities-in-xerox-printers/ - Third Party Advisory~~	() https://www.nccgroup.trust/us/our-research/technical-advisory-multiple-vulnerabilities-in-xerox-printers/ - Third Party Advisory

Information

Published : 2020-03-13 19:15

Updated : 2024-11-21 04:24

NVD link : CVE-2019-13171

Mitre link : CVE-2019-13171

CVE.ORG link : CVE-2019-13171

JSON object : View

Products Affected

xerox

phaser_3320
phaser_3320_firmware

CWE

CWE-787

Out-of-bounds Write

{"id": "CVE-2019-13171", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 10.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2020-03-13T19:15:15.277", "references": [{"url": "https://security.business.xerox.com/", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.nccgroup.trust/us/our-research/technical-advisory-multiple-vulnerabilities-in-xerox-printers/", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://security.business.xerox.com/", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.nccgroup.trust/us/our-research/technical-advisory-multiple-vulnerabilities-in-xerox-printers/", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-787"}]}], "descriptions": [{"lang": "en", "value": "Some Xerox printers (such as the Phaser 3320 V53.006.16.000) were affected by one or more stack-based buffer overflow vulnerabilities in the Google Cloud Print implementation that would allow an unauthenticated attacker to execute arbitrary code on the device. This was caused by an insecure handling of the register parameters, because the size used within a memcpy() function, which copied the action value into a local variable, was not checked properly."}, {"lang": "es", "value": "Algunas impresoras Xerox (tal y como la Phaser 3320 versi\u00f3n V53.006.16.000), fueron afectadas por una o m\u00e1s vulnerabilidades de desbordamiento de b\u00fafer en la regi\u00f3n stack de la memoria en la implementaci\u00f3n de Google Cloud Print que permitir\u00eda a un atacante no autenticado ejecutar c\u00f3digo arbitrario en el dispositivo. Esto fue causado por un manejo no seguro del par\u00e1metro register, porque el tama\u00f1o usado dentro de una funci\u00f3n memcpy(), que copi\u00f3 el valor de la acci\u00f3n en una variable local, no fue comprobado apropiadamente."}], "lastModified": "2024-11-21T04:24:21.120", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:xerox:phaser_3320_firmware:v53.006.16.000:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0683FED0-AF80-4717-A556-9B1DA9041F80"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:xerox:phaser_3320:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "82C5628C-DC4E-472A-9AD8-35C3CA7BD1A9"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@mitre.org"}