[Japanese]

JVNDB-2023-004919

FUJIFILM Business Innovation Corp. and Xerox Corporation MFPs export Address Books with insufficient encryption strength

Overview

Multiple MFPs (multifunction printers) provided by FUJIFILM Business Innovation Corp. and Xerox Corporation provide a facility to export the contents of their Address Book with encrypted form, but the encryption strength is insufficient (CWE-1391).

Kunal Thakrar and Ceri Coburn of Pen Test Partners directly reported this vulnerability to FUJIFILM Business Innovation Corp.
FUJIFILM Business Innovation Corp. reported this case to JPCERT/CC to request the coordination with the reporter.
CVSS Severity (What is CVSS?)

CVSS V3 Severity:
Base Metrics 5.4 (Medium) [Other]
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Changed
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None
Comment
This CVSSv3 Score was assessed based on the assumed attack scenario below.
1) An attacker obtains the exported Address Book data
2) Tamper a file on the sever by obtaining the credentials used for connecting to the sever where the scanned data is saved
Affected Products

As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed below.

* FUJIFILM Business Inovation Corp.
* Xerox Corporation

Xerox
  • (multiple product)
FUJIFILM Business Innovation Corp. (former Fuji Xerox Co., Ltd.)
  • (multiple product)

Impact

With the knowledge of the encryption process and the encryption key, the information such as the server credentials may be obtained from the exported Address Book data.

Solution

[Update the firmware]
Apply the appropriate firmware update according to the information provided by the respective vendors.
For the details of the updates, refer to the information provided by the respective vendors from [Vendor Status] section.
Vendor Information

Xerox FUJIFILM Business Innovation Corp. (former Fuji Xerox Co., Ltd.)
CWE (What is CWE?)

  1. Use of Weak Credentials(CWE-1391) [Other]
CVE (What is CVE?)

  1. CVE-2023-46327
References

  1. JVN : JVNVU#96482726
Revision History

  • [2023/11/02]
      Web page was published

Date Public2023/11/01
Date First Published2023/11/02
Date Last Updated2023/11/02