Sign-up

ID

VAR-202003-0921


CVE

CVE-2019-13171


TITLE

plural Xerox Out-of-bounds write vulnerabilities in printers

Trust: 0.8

sources: JVNDB: JVNDB-2019-014941

DESCRIPTION

Some Xerox printers (such as the Phaser 3320 V53.006.16.000) were affected by one or more stack-based buffer overflow vulnerabilities in the Google Cloud Print implementation that would allow an unauthenticated attacker to execute arbitrary code on the device. This was caused by an insecure handling of the register parameters, because the size used within a memcpy() function, which copied the action value into a local variable, was not checked properly. plural Xerox The printer contains a vulnerability related to out-of-bounds writing.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be put into a state. Fuji Xerox Corporation is the world's largest manufacturer of digital and information technology products and a global top 500 company. Fuji Xerox series printer products can meet various business needs. All kinds of black and white color digital printers have high performance and high quality

Trust: 2.16

sources: NVD: CVE-2019-13171 // JVNDB: JVNDB-2019-014941 // CNVD: CNVD-2020-19214

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2020-19214

AFFECTED PRODUCTS

vendor:xeroxmodel:phaser 3320scope:eqversion:v53.006.16.000

Trust: 1.0

vendor:xeroxmodel:phaser 3320scope: - version: -

Trust: 0.8

vendor:fujimodel:xerox phaserscope:eqversion:3320v53.006.16.000

Trust: 0.6

sources: CNVD: CNVD-2020-19214 // JVNDB: JVNDB-2019-014941 // NVD: CVE-2019-13171

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2019-13171
value: CRITICAL

Trust: 1.0

NVD: JVNDB-2019-014941
value: CRITICAL

Trust: 0.8

CNVD: CNVD-2020-19214
value: HIGH

Trust: 0.6

CNNVD: CNNVD-202003-852
value: CRITICAL

Trust: 0.6

nvd@nist.gov: CVE-2019-13171
severity: HIGH
baseScore: 10.0
vectorString: AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.0

NVD: JVNDB-2019-014941
severity: HIGH
baseScore: 10.0
vectorString: AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: NONE
impactScore: NONE
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.8

CNVD: CNVD-2020-19214
severity: HIGH
baseScore: 10.0
vectorString: AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

nvd@nist.gov: CVE-2019-13171
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 5.9
version: 3.1

Trust: 1.0

NVD: JVNDB-2019-014941
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: CNVD: CNVD-2020-19214 // JVNDB: JVNDB-2019-014941 // CNNVD: CNNVD-202003-852 // NVD: CVE-2019-13171

PROBLEMTYPE DATA

problemtype:CWE-787

Trust: 1.8

sources: JVNDB: JVNDB-2019-014941 // NVD: CVE-2019-13171

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202003-852

TYPE

buffer error

Trust: 0.6

sources: CNNVD: CNNVD-202003-852

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2019-014941

PATCH
title:Xerox Security Information, Bulletins and Advisory Responsesurl:https://security.business.xerox.com/
Trust: 0.8
title:Patch for Fuji Xerox printers buffer overflow vulnerability (CNVD-2020-19214)url:https://www.cnvd.org.cn/patchInfo/show/210737
Trust: 0.6
title:Xerox Phaser 3320 Buffer error vulnerability fixurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=112073
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2020-19214 // 
            
            
            
            JVNDB: JVNDB-2019-014941 // 
            
            
            
            CNNVD: CNNVD-202003-852

EXTERNAL IDS
db:NVDid:CVE-2019-13171
Trust: 3.0
db:JVNDBid:JVNDB-2019-014941
Trust: 0.8
db:CNVDid:CNVD-2020-19214
Trust: 0.6
db:CNNVDid:CNNVD-202003-852
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2020-19214 // 
            
            
            
            JVNDB: JVNDB-2019-014941 // 
            
            
            
            CNNVD: CNNVD-202003-852 // 
            
            
            
            NVD: CVE-2019-13171

REFERENCES
url:https://www.nccgroup.trust/us/our-research/technical-advisory-multiple-vulnerabilities-in-xerox-printers/
Trust: 2.4
url:https://security.business.xerox.com/
Trust: 1.6
url:https://nvd.nist.gov/vuln/detail/cve-2019-13171
Trust: 1.4
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-13171
Trust: 0.8
url:https://nvd.nist.gov/vuln/detail/cve-2019-13169
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2020-19214 // 
            
            
            
            JVNDB: JVNDB-2019-014941 // 
            
            
            
            CNNVD: CNNVD-202003-852 // 
            
            
            
            NVD: CVE-2019-13171

SOURCES
db:CNVDid:CNVD-2020-19214
db:JVNDBid:JVNDB-2019-014941
db:CNNVDid:CNNVD-202003-852
db:NVDid:CVE-2019-13171

LAST UPDATE DATE
2024-11-23T21:59:23.415000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2020-19214date:2020-03-25T00:00:00
db:JVNDBid:JVNDB-2019-014941date:2020-03-30T00:00:00
db:CNNVDid:CNNVD-202003-852date:2020-04-02T00:00:00
db:NVDid:CVE-2019-13171date:2024-11-21T04:24:21.120

SOURCES RELEASE DATE
db:CNVDid:CNVD-2020-19214date:2020-03-25T00:00:00
db:JVNDBid:JVNDB-2019-014941date:2020-03-30T00:00:00
db:CNNVDid:CNNVD-202003-852date:2020-03-13T00:00:00
db:NVDid:CVE-2019-13171date:2020-03-13T19:15:15.277