Multiple Vendors Multiple EAS Devices CVE-2013-4734 Predictable Password Generation Vulnerability

Bugtraq ID:	60913
Class:	Design Error
CVE:	CVE-2013-4734
Remote:	Yes
Local:	No
Published:	Jun 26 2013 12:00AM
Updated:	Jun 26 2013 12:00AM
Credit:	Mike Davis and Cesar Cerrudo of IOActive
Vulnerable:	Monroe Electronics R189SE One-NetSE 0 Monroe Electronics R189 One-Net 0 Digital Alert Systems DASDEC-II 0 Digital Alert Systems DASDEC-I 0
Not Vulnerable:	Monroe Electronics R189SE One-NetSE 2.0-2 Monroe Electronics R189 One-Net 2.0-2 Digital Alert Systems DASDEC-II 2.0-2 Digital Alert Systems DASDEC-I 2.0-2

Multiple Vendors Multiple EAS Devices CVE-2013-4734 Predictable Password Generation Vulnerability

Multiple EAS devices from multiple vendors are prone to an insecure password generation vulnerability.

Successfully exploiting this issue may allow an attacker to guess generated passwords and obtain non-administrative access to the device.

The following products are affected:

Digital Alert Systems DASDEC-I
Digital Alert Systems DASDEC-II
Monroe Electronics R189 One-Net
Monroe Electronics R189SE One-NetSE

Multiple Vendors Multiple EAS Devices CVE-2013-4734 Predictable Password Generation Vulnerability

An attacker can exploit this issue using a web browser.

Multiple Vendors Multiple EAS Devices CVE-2013-4734 Predictable Password Generation Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Multiple Vendors Multiple EAS Devices CVE-2013-4734 Predictable Password Generation Vulnerability

References:

• Digital Alert Systems Homepage (Digital Alert Systems)
  
• Digital Alert Systems Information for VU#662676 (CERT)
  
• Monroe Electronics Homepage (Monroe Electronics)
  
• Monroe Electronics Information for VU#662676 (CERT)
  
• Vulnerability Note VU#662676 (CERT)