NVD Vulnerability Detail

CVE-2013-4734

Summary	dasdec_mkuser on the Digital Alert Systems DASDEC EAS device before 2.0-2 and the Monroe Electronics R189 One-Net EAS device before 2.0-2 generates predictable passwords, which might make it easier for attackers to obtain non-administrative access via unspecified vectors.
Publication Date	July 1, 2013, 4:28 a.m.
Registration Date	Jan. 26, 2021, 3:44 p.m.
Last Update	Nov. 21, 2024, 10:56 a.m.

Affected software configurations

Configuration1	or higher	or less	more than	less than
cpe:2.3:h:monroe_electronics:r189_one-net_eas::::::::		2.0-1
cpe:2.3:h:monroe_electronics:r189_one-net_eas:2.0-0:::::::*
cpe:2.3:h:digital_alert_systems:dasdec_eas:2.0-0:::::::*
cpe:2.3:h:digital_alert_systems:dasdec_eas::::::::		2.0-1

Related information, measures and tools

No	URL	タグ
1	http://www.digitalalertsystems.com/pdf/130604-Monroe-Security-PR.pdf	Vendor Advisory
2	http://www.digitalalertsystems.com/pdf/130604-Monroe-Security-PR.pdf	Vendor Advisory
3	http://www.kb.cert.org/vuls/id/662676	US Government Resource
4	http://www.kb.cert.org/vuls/id/662676	US Government Resource
5	http://www.kb.cert.org/vuls/id/AAMN-98MU7H	US Government Resource
6	http://www.kb.cert.org/vuls/id/AAMN-98MU7H	US Government Resource
7	http://www.kb.cert.org/vuls/id/AAMN-98MUK2	US Government Resource
8	http://www.kb.cert.org/vuls/id/AAMN-98MUK2	US Government Resource
9	http://www.monroe-electronics.com/MONROE_ELECTRONICS_PDF/130604-Monroe-Security-PR.pdf	Vendor Advisory
10	http://www.monroe-electronics.com/MONROE_ELECTRONICS_PDF/130604-Monroe-Security-PR.pdf	Vendor Advisory

Common Vulnerabilities List

JVN Vulnerability Information

Digital Alert Systems DASDEC EAS および Monroe Electronics R189 One-Net EAS における非管理者アクセス権を取得される脆弱性

Title	Digital Alert Systems DASDEC EAS および Monroe Electronics R189 One-Net EAS における非管理者アクセス権を取得される脆弱性
Summary	Digital Alert Systems DASDEC EAS デバイスおよび Monroe Electronics R189 One-Net EAS デバイスの dasdec_mkuser は、予測可能なパスワードを生成するため、非管理者アクセス権を取得される脆弱性が存在します。
Possible impacts	攻撃者により、非管理者アクセス権を取得される可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	April 24, 2013, midnight
Registration Date	July 2, 2013, 4:50 p.m.
Last Update	July 2, 2013, 4:50 p.m.

Affected System

Monroe Electronics

R189 One-Net EAS 2.0-2 未満

Digital Alert Systems

DASDEC EAS 2.0-2 未満

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2013-4734	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4734
National Vulnerability Database (NVD)
2	CVE-2013-4734	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-4734

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-noinfo	https://www.ipa.go.jp/security/vuln/CWE.html#CWEnoinfo

ベンダー情報

No	Name	URL
Digital Alert Systems
1	Monroe Electronics Provides New Software Update Enhancing Security and Functionality	http://www.digitalalertsystems.com/pdf/130604-Monroe-Security-PR.pdf
Monroe Electronics
2	Monroe Electronics Provides New Software Update Enhancing Security and Functionality	http://www.monroe-electronics.com/MONROE_ELECTRONICS_PDF/130604-Monroe-Security-PR.pdf
富士通セキュリティ情報
3	TA13-175A	http://software.fujitsu.com/jp/security/vulnerabilities/ta13-175a.html

その他

No	Name	URL
JVN
1	JVNVU#99235742	http://jvn.jp/cert/JVNVU99235742
US-CERT Technical Cyber Security Alert
2	TA13-175A	http://www.us-cert.gov/ncas/alerts/TA13-175A
US-CERT Vulnerability Note
3	Digital Alert Systems Information for VU#662676	http://www.kb.cert.org/vuls/id/AAMN-98MUK2
4	Monroe Electronics Information for VU#662676	http://www.kb.cert.org/vuls/id/AAMN-98MU7H
5	VU#662676	http://www.kb.cert.org/vuls/id/662676

Change Log

No	Changed Details	Date of change
0	[2013年07月02日] 掲載	Feb. 17, 2018, 10:37 a.m.