WorkCentre 5735/5740/5745/5755 Security Information
Xerox Security Mini Bulletin XRX16R_V1.0 (PDF 111.9K)
July 15, 2016
Contains fix for CVE-2015-2808 Bar Mitzvah, the RC4 algorithm has been removed.
Xerox Security Bulletin XRX16-006 V1.0 (PDF 165.1K)
April 15, 2016
New Common Criteria Certified release for WorkCentre 5755 only.
WorkCentre Removable Hard Drive Brochure (PDF 201.3K)
October 22, 2015
Xerox Security Mini Bulletin XRX15Q V1.0 (PDF 69.9K)
May 13, 2015
Xerox Security Mini Bulletin XRX15N V1.0 (PDF 105.6K)
April 06, 2015
Xerox Security Mini Bulletin XRX15E V1.0 (PDF 168.5K)
March 02, 2015
Hard Drive Retention Offering for Xerox Products in the United States (PDF 264.5K)
February 02, 2015
Xerox Mini Security Bulletin XRX14F v1.0 (PDF 251.9K)
September 17, 2014
NOTE: This Bulletin is ONLY intended for the specific security problem(s) rated as IMPORTANT for the following products.
Xerox Mini Security Bulletin XRX14A v1.0 (PDF 453.1K)
May 20, 2014
NOTE: This Bulletin is ONLY intended for the specific security problem(s) rated as critical for the following products.
Xerox Security Bulletin XRX12-005 V1.1 (PDF 103.3K)
March 25, 2013
The Xerox devices ColorQube® 9201/9202/9203, ColorQube® 9301/9302/9303, WorkCentre® 232/238/245/255/265/275, WorkCentre® 5030/5050, WorkCentre® 5135/5150, WorkCentre® 5632/5638/5645/5655/5665/5675/5687, WorkCentre® 5735/5740/5745/5755/5765/5775/5790, WorkCentre® 6400, WorkCentre® 7525/7530/7535/7545/7556, WorkCentre® 7655/7665/7675, WorkCentre® 7755/7765/7775, WorkCentre® Bookmark 40/55, WorkCentre Pro® 232/238/245/255/265/275 were shipped with certain protocols enabled that, if properly exploited, could be used to gain
unauthorized access to the system. These particular protocols should not have been present in the production configuration and need to be removed from that configuration to minimize the possibility of unauthorized system access.
A software solution (patch P49) is provided for the products listed. This solution will remove from the production configuration the unwanted protocols in question so they can’t be exploited to gain unauthorized access to the system.
This solution is designed to be installed by the customer. The software solution is compressed into a 3 KB zip file and can be accessed via the link below or via the link following this bulletin announcement on http://www.xerox.com/security.
Software available through this link:
(zip archive 2.5K)
Xerox Security Bulletin XRX12-008 v1.0 (PDF 63.2K)
October 15, 2012
Cumulative update for Common Criteria Certification
System Software Version 061.132.222.03800 for the WorkCentre 5735/5740/5745/5755/5765/5775/5790 models is a cumulative update that incorporates security vulnerability fixes up through 09 Feb 2012 as well as other non-security related defect fixes. This release is Common Criteria certified (see http://www.xerox.com/information-security/common-criteria-certified/enus.html).
This system software release for the products listed is designed to be installed by the customer. This system software version is a full system release so the patch criticality rating is not applicable. The software release is compressed into a 295.9 MB zip file and can be accessed via the link below or via the link contained in the bulletin.
WorkCentre_5735-5740-5745-5755-5765-5775-5790_Information_Assurance_Disclosure_Paper_v4.0 (PDF 1.1M)
May 14, 2012
Xerox Security Bulletin XRX12-003 v1.1 (PDF 185.5K)
March 07, 2012
NOTE: We are re-issuing this bulletin due to a spelling error of the name of one of the researchers. No technical content in the bulletin has changed.
Vulnerabilities exist that, if exploited, could allow remote attackers to insert arbitrary code into the device. This could occur with a specifically crafted Postscript or firmware job submitted to the device. If successful, an attacker could make unauthorized changes to the system configuration; however, customer and user passwords are not exposed.
As part of Xerox’s on-going efforts to protect customers, the ability to accept these specially crafted jobs can be disabled for the affected products listed in the bulletin. Links for the software needed are contained inside the bulletin.
Secure Installation and Operation of Your WorkCentre5735/5740/5745/5755/5765/5775/5790 v1.3 (PDF 188.7K)
October 23, 2011
Xerox Security Bulletin XRX11-002 (PDF 92K)
March 25, 2011
A vulnerability documented in CVE-2010-2063 exists that, if exploited, could allow remote attackers to execute arbitrary code via specially crafted fields in a Service Message Block (SMB) packet. This could occur with buffer overflows in the Samba third-party code that handles file and printer sharing services for SMB clients (including Xerox MFD devices). If successful, an attacker could make unauthorized changes to the system configuration; however, customer and user passwords are not exposed. This vulnerability affects only the printer sharing services.
> Download the Software Update for the WorkCentre 5735/5740/5745/5755/5765/5775/5790
(zip archive 1.4M)
WorkCentre 5735-5740-5745-5755-5765-5775-5790 Statement of Volatility (PDF 281.6K)
January 28, 2011
Xerox Security Bulletin XRX10-005 (PDF 79.9K)
December 10, 2010
A software defect exists in the WorkCentre 5735/5740/5745/5755/5765/5775/5790 with the scan to email function that can result in two different scan to email documents being merged into one document. This issue is most likely to occur on devices with a color scanner when scanning complex documents at higher resolutions.
> Download the System Software for the WorkCentre 5735/5740/5745/5755/5765/5775/5790
(zip archive 624.4K)