Vulnerability CVE-2006-5290 - CERT Civis.Net

Vulnerability Name:

CVE-2006-5290 (CCN-29357)

Assigned:

2006-10-03

Published:

2006-10-03

Updated:

2017-07-20

Summary:

The ESS/ Network Controller and MicroServer Web Server components of Xerox WorkCentre and WorkCentre Pro 232, 238, 245, 255, 265 and 275 allow remote attackers to bypass authentication and execute arbitrary code via "WebUI command injection on TCP/IP hostname."

CVSS v3 Severity:

7.3 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): Low Integrity (I): Low Availibility (A): Low

CVSS v2 Severity:

7.5 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
5.5 Medium (Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Authentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): Partial Availibility (A): Partial

7.5 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
5.5 Medium (CCN Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Athentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): Partial Availibility (A): Partial

Vulnerability Type:

Vulnerability Consequences:

Gain Access

References:

Source: CCN
Type: XEROX Security Bulletin XRX06-005
Vulnerability in the ESS/ Network Controller and MicroServer Web Server could allow remote execution of arbitrary software

Source: MITRE
Type: CNA
CVE-2006-5290

Source: CCN
Type: SA22252
Xerox ESS/ Network Controller and MicroServer "WebUI" Vulnerability

Source: SECUNIA
Type: Patch, Vendor Advisory
22252

Source: CCN
Type: SECTRACK ID: 1016981
Xerox WorkCentre Input Validation Flaw in `hostname` Parameter Lets Remote Users Execute Arbitrary Code

Source: SECTRACK
Type: UNKNOWN
1016981

Source: CCN
Type: OSVDB ID: 29507
XEROX WorkCentre WebUI Arbitrary Command Execution

Source: CCN
Type: OSVDB ID: 31803
XEROX WorkCentre Products Web User Interface TCP/IP Hostname Command Injection

Source: CCN
Type: OSVDB ID: 31804
XEROX WorkCentre Products Web User Interface Scan-to-mailbox Folder Name Command Injection

Source: CCN
Type: OSVDB ID: 31805
XEROX WorkCentre Products Web User Interface Microsoft Networking Configuration Command Injection

Source: CCN
Type: BID-20334
Xerox Multiple Product Arbitrary Command Execution Vulnerability

Source: BID
Type: Patch
20334

Source: VUPEN
Type: UNKNOWN
ADV-2006-3921

Source: CONFIRM
Type: Patch
http://www.xerox.com/downloads/usa/en/c/cert_XRX06_005.pdf

Source: XF
Type: UNKNOWN
xerox-hostname-command-execution(29357)

Source: XF
Type: UNKNOWN
xerox-hostname-command-execution(29357)

Vulnerable Configuration:

Configuration 1:

cpe:/h:xerox:workcentre_232:*:*:*:*:*:*:*:*

OR cpe:/h:xerox:workcentre_232:*:*:pro:*:*:*:*:*

OR cpe:/h:xerox:workcentre_238:*:*:*:*:*:*:*:*

OR cpe:/h:xerox:workcentre_238:*:*:pro:*:*:*:*:*

OR cpe:/h:xerox:workcentre_245:*:*:*:*:*:*:*:*

OR cpe:/h:xerox:workcentre_245:*:*:pro:*:*:*:*:*

OR cpe:/h:xerox:workcentre_255:*:*:*:*:*:*:*:*

OR cpe:/h:xerox:workcentre_255:*:*:pro:*:*:*:*:*

OR cpe:/h:xerox:workcentre_265:*:*:*:*:*:*:*:*

OR cpe:/h:xerox:workcentre_265:*:*:pro:*:*:*:*:*

OR cpe:/h:xerox:workcentre_275:*:*:*:*:*:*:*:*

OR cpe:/h:xerox:workcentre_275:*:*:pro:*:*:*:*:*

Configuration CCN 1:

cpe:/h:xerox:workcentre_pro:232:*:*:*:*:*:*:*

OR cpe:/h:xerox:workcentre_pro:238:*:*:*:*:*:*:*

OR cpe:/h:xerox:workcentre_pro:245:*:*:*:*:*:*:*

OR cpe:/h:xerox:workcentre_pro:255:*:*:*:*:*:*:*

OR cpe:/h:xerox:workcentre_pro:265:*:*:*:*:*:*:*

OR cpe:/h:xerox:workcentre_pro:275:*:*:*:*:*:*:*

OR cpe:/h:xerox:workcentre:232:*:*:*:*:*:*:*

OR cpe:/h:xerox:workcentre:238:*:*:*:*:*:*:*

OR cpe:/h:xerox:workcentre:245:*:*:*:*:*:*:*

OR cpe:/h:xerox:workcentre:255:*:*:*:*:*:*:*

OR cpe:/h:xerox:workcentre:265:*:*:*:*:*:*:*

OR cpe:/h:xerox:workcentre:275:*:*:*:*:*:*:*

Denotes that component is vulnerable