Multiple Vendors Multiple EAS Devices CVE-2013-4733 Information Disclosure Vulnerability

Bugtraq ID:	60911
Class:	Design Error
CVE:	CVE-2013-4733
Remote:	Yes
Local:	No
Published:	Jun 26 2013 12:00AM
Updated:	Jun 26 2013 12:00AM
Credit:	Mike Davis and Cesar Cerrudo of IOActive
Vulnerable:	Monroe Electronics R189SE One-NetSE 0 Monroe Electronics R189 One-Net 0 Digital Alert Systems DASDEC-II 0 Digital Alert Systems DASDEC-I 0
Not Vulnerable:	Monroe Electronics R189SE One-NetSE 2.0-2 Monroe Electronics R189 One-Net 2.0-2 Digital Alert Systems DASDEC-II 2.0-2 Digital Alert Systems DASDEC-I 2.0-2

Multiple Vendors Multiple EAS Devices CVE-2013-4733 Information Disclosure Vulnerability

Multiple Vendors EAS Devices are prone to an information-disclosure vulnerability.

An attacker can exploit this issue to obtain sensitive information that may lead to further attacks.

The following products are affected:

Digital Alert Systems DASDEC-I
Digital Alert Systems DASDEC-II
Monroe Electronics R189 One-Net
Monroe Electronics R189SE One-NetSE

Multiple Vendors Multiple EAS Devices CVE-2013-4733 Information Disclosure Vulnerability

An attacker can exploit this issue using a web browser.

Multiple Vendors Multiple EAS Devices CVE-2013-4733 Information Disclosure Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Multiple Vendors Multiple EAS Devices CVE-2013-4733 Information Disclosure Vulnerability

References:

• Digital Alert Systems Homepage (Digital Alert Systems)
  
• Digital Alert Systems Information for VU#662676 (CERT)
  
• Monroe Electronics Homepage (Monroe Electronics)
  
• Monroe Electronics Information for VU#662676 (CERT)
  
• Vulnerability Note VU#662676 (CERT)