NIAP: Assurance Continuity
NIAP/CCEVS
  NIAP  »»  Product Compliant List  »»  Product Entry  »»  Assurance Continuity  
Assurance Continuity - Xerox® AltaLink™ B8045 / B8055 / B8065 / B8075 / B8090

Date of Maintenance Completion:  2021.06.23

Product Type:    Multi Function Device

Conformance Claim:  Protection Profile Compliant

PP Identifier:    Protection Profile for Hardcopy Devices Version 1.0

Original Evaluated TOE:  2019.07.22 - Xerox® AltaLink™ B8045 / B8055 / B8065 / B8075 / B8090

CC Certificate [PDF] Validation Report [PDF] Assurance Activity [PDF]

Administrative Guide [PDF]

Please note:  The above files are for the Original Evaluated TOE.  Consequently, they do not refer to this maintained version, although they apply to the maintained version. 

Security Target [PDF] * Assurance Continuity Maintenance Report [PDF] Administrative Guide [PDF]

Please note:  This serves as an addendum to the VR for the Original Evaluated TOE. 

* This is the Security Target (ST) associated with this latest Maintenance Release.  To view previous STs for this TOE, click here.

Readers are reminded that the certification of this product (TOE) is the result of maintenance, rather than an actual re-evaluation of the product.  Maintenance only considers the affect of TOE changes on the assurance baseline (i.e. the original evaluated TOE); maintenance is not intended to provide assurance in regard to the resistance of the TOE to new vulnerabilities or attack methods discovered since the date of the initial certificate.  Such assurance can only be gained through re-evaluation. 

Using a security impact analysis of the changes made to the TOE, which was provided by the developer, the CCEVS has determined that the impact of changes on the TOE are considered minor and that independent evaluator analysis was not necessary.  A summary of the results can be found in the Maintenance Report, which is written in relation to the product's original validation report and Security Target.  Readers are therefore reminded to read the Security Target, Validation Report, and the Assurance Maintenance Report to fully understand the meaning of what a maintained certificate represents. 

Product Description

Description of ASE Changes:

Changes to the Security Target regarding the toner bug are described in [MR1].

Changes to the Security Target (since version 0.9 decribed in [MR2]) are as follows:

a)      Document version

b)      Copyright year

c)      Remove DXC.technology

d)      Firmware version updated with new patch 553131v3.dlm

e)      FMT_SMF.1.1 – remove assignment to enable/disable disk encryption (always enabled)

Description of ALC Changes:

The CI List was updated with the new Security Target revision. No other documentation was affected.

Description of AGD Changes:

Changes to the [AGD] (since version 1.7 described in [MR2]) are as follows:

a)      Document version

b)      Copyright year

c)      Remove configuration steps for enabling and disabling data encryption. 

d)      State that data encryption is enabled by default at the factory and cannot be disabled.

Assurance Continuity Maintenance Report:

·        Lightship submitted an Impact Analysis Report (IAR) on behalf of Xerox for the Xerox Multi-Factor Device Security Target Xerox® AltaLink™  B8045 / B8055 / B8065 / B8075 / B8090.

·        The Impact Analysis Report (IAR) document the changes incorporated into Software Patch 553131v3.dlm which addresses public vulnerabilites/CVEs as shown in the table below. The IAR indicates that the impact of all the individual changes is minor so it concludes that the sum of all the changes to the TOE have only minor impact. 

·        There are no changes to the IT Environment

·        There are no changes to the Development Environment

 

                             Table: TOE Changes to address CVEs

CVE Product ID

Summary/Description

TSF Impact/Mitigation

CVE-2019-10881

Xerox AltaLink B8045/B8055/B8065/B8075/B8090, AltaLink C8030/C8035/C8045/C8055/C8070 with software releases before 103.xxx.030.32000 includes two accounts with weak hard-coded passwords which can be exploited and allow unauthorized access which cannot be disabled.

Minor code fix to ensure that the ‘Guest’ and ‘ForceOnBoxLogin’ accounts no longer have hard-coded passwords. These users are not available as a login account from any interface. These accounts are internal system accounts with randomly created passwords that are not modifiable by admin and other users.

CVE-2021-28669

Xerox AltaLink B80xx before 103.008.020.23120, C8030/C8035 before 103.001.020.23120, C8045/C8055 before 103.002.020.23120 and C8070 before 103.003.020.23120 provide the ability to set WebUI configuration attributes without administrative rights.

Minor code fix that removed the ability to set WebUI configuration attributes.

CVE-2021-28670

Xerox AltaLink B8045/B8090 before 103.008.030.32000, C8030/C8035 before 103.001.030.32000, C8045/C8055 before 103.002.030.32000 and C8070 before 103.003.030.32000 allow unauthorized users, by leveraging the ‘Scan To’ Mailbox feature, to delete arbitrary files from the disk.

Minor code fix that removed the ability of unauthorized users to delete arbitrary files from the disk.

CVE-2021-28668

Xerox AltaLink B80xx before 103.008.020.23120, C8030/C8035 before 103.001.020.23120, C8045/C8055 before 103.002.020.23120 and C8070 before 103.003.020.23120 has several SQL injection vulnerabilities.

Minor code fix that removed all SQL server injections.

CVE-2019-18630

On Xerox AltaLink B8045/B8055/B8065/B8075/B8090 and C8030/C8035/C8045/C8055/C8070 multifunction printers with software releases before 101.00x.099.28200, portions of the drive containing executable code were not encrypted thus leaving it open to potential cryptographic information disclosure.

None – This vulnerability is not exploitable in the evaluated configuration. To exploit, an attacker requires physical access and advanced attack techniques to be able to access keys used to create or extract clone files. Further, an attacker would also need admin role access to an MFP in order to download or install one of these clone files. If the attacker is successful in creating and delivering a handcrafted clone file, there is no known way that the device can be exploited by such a clone file.

CVE-2019-18629

Xerox AltaLink B8045/B8055/B8065/B8075/B8090 and C8030/C8035/C8045/C8055/C8070 multifunction printers with software releases before 101.00x.099.28200 allow an attacker to execute an unwanted binary during a exploited clone install. This requires creating a clone file and signing that file with a compromised private key.

Minor code fix –. Modified iptables to prevent the ability to run an unexpected binary.

CVE-2019-18628

Xerox AltaLink B8045/B8055/B8065/B8075/B8090 and C8030/C8035/C8045/C8055/C8070 multifunction printers with software releases before 101.00x.099.28200 allow a user with administrative privileges to turn off data encryption on the device, thus leaving it open to potential cryptographic information disclosure.

Minor code fix that removed the ability to enable/disable disk encryption. It is enabled at all times and customer cannot disable. ST was updated to remove enable/disable capability from assignment in FMT_SMF.1 (evaluated configuration required disk encryption to be enabled). 

 

Vendor Information


Xerox
Alan Sukert
5854271413
Alan.Sukert@Xerox.com

www.xerox.com
Site Map              Contact Us              Home