background image

XEROX WorkCentre 

3550 

Information Assurance Disclosure Paper 

 

30 

Ver. 1.3, March 2011 

        

Page 

 30 of 32 

RFC 1514 – Host Resources MIB group

 

WorkCentre

 

System group [

7 objects

supported 

Storage group [

8 objects

]  

supported 

Devices group [

6 objects

supported

 

Processor Table [

2 objects

supported 

Network Interface Table [

1 object

supported 

Printer Table [

2 objects

supported 

Disk Storage Table [

4 objects

supported 

Partition Table [

5 objects

supported 

File System Table [

9 objects

supported

 

Software Running group [

7 objects

] – 

OPTIONAL

 

Not supported 

 

Software Running Performance group [

2 objects

] – 

OPTIONAL

  Not supported 

 

Software Installed group [

7 objects

] – 

OPTIONAL

 

Not supported 

 

 

RFC 1213 - MIB-II for TCP/IP group

 

WorkCentre

 

System group [

7 objects

supported 

Interfaces group [

23 objects

supported 

Address Translation group [

3 objects

supported, but this group has been DEPRECATED by the IETF 

IP group [

42 objects

supported 

ICMP group [

26 objects

supported 

TCP group [

19 objects

supported 

UDP group [

6 objects

supported 

EGP group [

20 objects

not applicable because Exterior Gateway Protocol not supported by 
machine 

Transmission group [

0 objects

not applicable because the group has not yet been defined by the IETF 

SNMP group [

28 objects

supported 

System Object Resources Table/objects per RFC 1907 [

objects

]  

supported 

 

Additional Capabilities / Application Support 

WorkCentre

 

ability to change GET, SET, TRAP PDU community names 

supported 

Printer MIB traps 

supported = printerV1Alert, printerV2Alert 

SNMP Generic Traps 

supported = coldStart, warmStart, authenticationFailure 

Vendor-specific Traps 

supported = xcmJobV1AlertNew, xcmJobV2AlertNew for job monitoring 
alerts 

set trap destination address(es) for any 3rd party Net Mgmt 
apps. 

supported via Web UI 

polling for IETF status objects using any 3rd party Net Mgmt 
apps. 

supported 

walking IETF MIB tree structure using any 3rd party Net Mgmt 
app. (e.g. HP OpenView, etc.) / shareware program 

supported 

New type 2 enumerations from next generation Host 
Resources MIB supported 

optional, not supported because Host Resources MIBv2 has NOT entered 
the standards track 

New type 2 enumerations from next generation Printer MIB 
supported 

supported 

New Printer MIBv2 objects implemented 

optional, not support because Printer MIBv2 has NOT entered the 
standards track 

IETF AppleTalk MIB (RFC 1243) implemented 

not supported 

Job monitoring via MIBs 

supported via Xerox MIBs 

Vendor-specific client application(s) provided 

CentreWare Services 

required Windows2000 MIB objects supported 

supported 

Embedded Web Server support 

supported 

Xerox PrinterMap application support 

supported 

Xerox PrintXchange support 

supported 

Novell Distributed Print Services support 

supported = w/ Xerox NDPS Gateway solution w/ improved device status 

Dazel Output Management Environment 

supported 

HP OpenView snap-in module 

supported 

CA Unicenter snap-in module 

supported 

IBM/Tivoli NetView snap-in module 

supported 

 

Table 9 Supported MIB Objects 

 

Summary of Contents for WorkCentre 3550

Page 1: ...Xerox WorkCentre 3550 Information Assurance Disclosure Paper Version 1 2 Prepared by Mark Bixler Xerox Corporation 800 Phillips Road Webster New York 14580...

Page 2: ...March 2011 Page 2 of 32 2011 Xerox Corporation All rights reserved Xerox and the sphere of connectivity design are trademarks of Xerox Corporation in the United States and or other counties Other com...

Page 3: ...2 2 4 USB Ports 10 2 3 Fax Module 11 2 3 1 Purpose 11 2 3 2 Hardware 11 2 4 Scanner 11 2 4 1 Purpose 11 2 4 2 Hardware 11 2 5 Local User Interface LUI 12 2 5 1 Purpose 12 2 5 2 Hardware 12 2 6 Markin...

Page 4: ...ultifunction models only 24 3 3 2 Network Scanning Multifunction models only 24 3 4 Diagnostics 24 4 SECURITY ASPECTS OF SELECTED FEATURES 25 4 1 SMart eSolutions 25 4 2 1 Meter Assistant 25 4 2 2 Sup...

Page 5: ...n functions and features of the WorkCentre products relative to Information Assurance IA This document does NOT provide tutorial level information about security connectivity PDLs or WorkCentre produc...

Page 6: ...input document handler and scanner marking engine including paper path controller and user interface Figure 2 1 WorkCentre Multifunction System Document Feeder Scanner IIT Marking Engine IOT Paper Tra...

Page 7: ...Disclosure Paper 7 Ver 1 3 March 2011 Page 7 of 32 2 1 Security relevant Subsystems 2 1 1 Physical Partitioning The security relevant subsystems of the product are partitioned as shown in Figure 2 2...

Page 8: ...ce Network Authentication Controller Graphical User Interface Cryptographic Operations Controller User Data Protection SSL Controller User Data Protection IP Filtering Controller User Data Protection...

Page 9: ...ead from DRAM and sent to the Image Output Terminal IOT for marking on hardcopy output For long documents the production of hardcopy may begin before the entire original is scanned achieving a level o...

Page 10: ...are limited to controller parameters that are needed for normal operation Both ports can be disabled by an Admin via the WebUI USB USB port and location Purpose USB 2 0 Host port Printing from USB sc...

Page 11: ...rk Volatile Memory Description Type SRAM DRAM etc Size User Modifiable Y N Function or Use Process to Clear None n a n a n a n a Additional Information Non Volatile Memory Description Type Flash EEPRO...

Page 12: ...n Type Flash EEPROM etc Size User Modifiable Y N Function or Use Process to Clear PROM 64KB N No user image data stored None Additional Information All memory listed above contains code for execution...

Page 13: ...bupnp UUID library wpa_supplicant ldns Info zip TWAIN sample Data Source and Application WTL v8 0 CUPS library libjpeg v6b libxml2 Expat XML Parser Unicode Kerberos 5 sorttable Little CMS v1 15 libstd...

Page 14: ...Disclosure Paper 14 Ver 1 3 March 2011 Page 14 of 32 2 7 3 Network Protocols Figure 2 is an interface diagram depicting the protocol stacks supported by the device annotated according to the DARPA mo...

Page 15: ...and the device A shared secret is used to encrypt the traffic flowing through this tunnel SSL must be enabled in order to set up the shared secret When an IPSec tunnel is established between a client...

Page 16: ...TCP UDP SLP 443 TCP SSL 515 TCP LPR 546 UDP DHCPv6 631 TCP IPP 636 TCP sLDAP 1124 TCP UDP Network Scan Utility 1900 UDP SSDP 3003 TCP HTTP SNMP reply 5200 TCP UPnP 5353 UDP Multicast DNS 6000 UDP Set...

Page 17: ...view the properties of the device but not change them without logging into the machine with administrator privileges The HTTP server can only host the web pages resident on the device It does not and...

Page 18: ...ld be too difficult for the user SA to keep the device clock in sync with the Kerberos server so the Xerox instantiation of Kerberos has the clock skew check removed The disadvantage is that this give...

Page 19: ...SSL must also be enabled in order to use any of the Web Services Automatic Meter Reads or Network Scanning Validation Service SSL should be enabled so that the device can be securely administered fro...

Page 20: ...port and this port is active when the http server is active i e if the http server is disabled this port will be closed If someone attempted to send an SNMP reply to this port via the network the repl...

Page 21: ...nged from its default value immediately upon product installation The PIN should be set to a minimum of 8 characters in length and changed at least once per month Longer PINs can be changed less frequ...

Page 22: ...t Authentication Steps 1 The device broadcasts an authentication request that is answered by the Domain Controller 2 The Domain Controller responds back to the device whether or not the user was succe...

Page 23: ...est directly to the Domain Controller through the router using the IP address of the Domain Controller 4 The Domain Controller responds back to the device through the router whether or not the user wa...

Page 24: ...Scan to E mail The device logs into an SMTP Server as set up by the SA via CWIS It will only log into the Server when a user attempts to use the scan to email feature At the time the LDAP server must...

Page 25: ...ation Server has been established the Meter Assistant service will poll the Xerox Communication server daily over the network The server will check whether it is time in the billing cycle to update th...

Page 26: ...Ver 1 3 March 2011 Page 26 of 32 5 Responses to Known Vulnerabilities 5 1 Security Xerox www xerox com security Xerox maintains an evergreen public web page that contains the latest security informati...

Page 27: ...kard HTTP Hypertext transfer protocol IBM International Business Machines ICMP Internet Control Message Protocol IETF Internet Engineering Task Force IFAX Internet Fax IIT Image Input Terminal the sca...

Page 28: ...e Location Protocol SNMP Simple Network Management Protocol SRAM Static Random Access Memory SSDP Simple Service Discovery Protocol SSL Secure Sockets Layer TCP Transmission Control Protocol TIFF Tagg...

Page 29: ...re supported as long as the basic MIB structures have been implemented SNMP version Network Transport support WorkCentre SNMPv1 RFC 1157 supported SNMPv2P RFCs 140x supported SNMPv2C RFCs 190x support...

Page 30: ...hange GET SET TRAP PDU community names supported Printer MIB traps supported printerV1Alert printerV2Alert SNMP Generic Traps supported coldStart warmStart authenticationFailure Vendor specific Traps...

Page 31: ...trap Protocol BOOTP 1542 X 500 Distinguished Name RFC references 1779 2253 2297 2293 SLP 2608 Dynamic Host Configuration Protocol DHCP 2131 DHCP Options and BOOTP Vendor Extensions 2132 X 509 Certific...

Page 32: ...re Paper 32 Ver 1 3 March 2011 Page 32 of 32 Portable Document Format Reference Manual Version 1 3 6 4 Appendix E References Kerberos FAQ http www nrl navy mil CCS people kenh kerberos faq html IP por...

Reviews: