VAR-201508-0275

Vulnerability from variot - Updated: 2023-12-18 12:07

GE Healthcare Centricity PACS Workstation 4.0 and 4.0.1 has a password of (1) CANal1 for the Administrator user and (2) iis for the IIS user, which has unspecified impact and attack vectors related to TimbuktuPro. NOTE: it is not clear whether this password is default, hardcoded, or dependent on another system or product that requires it. (1) For admin users CANal1 password (2) IIS For users iis password It is unknown whether this password is default, hard-coded, or dependent on other systems or products that require a fixed value.It may be subject to unspecified effects and attacks. An attacker could use this vulnerability to control the device. Attackers can exploit this issue to bypass the authentication mechanism and gain access to the vulnerable device

Show details on source website
To clipboard 

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-201508-0275",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "centricity pacs workstation",
        "scope": "eq",
        "trust": 2.2,
        "vendor": "gehealthcare",
        "version": "4.0.1"
      },
      {
        "model": "centricity pacs workstation",
        "scope": "eq",
        "trust": 2.2,
        "vendor": "gehealthcare",
        "version": "4.0"
      },
      {
        "model": "centricity pacs",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "ge healthcare",
        "version": "4.0"
      },
      {
        "model": "centricity pacs",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "ge healthcare",
        "version": "4.0.1"
      },
      {
        "model": "centricity pacs workstation",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "ge",
        "version": "4.0"
      },
      {
        "model": "centricity pacs workstation",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "ge",
        "version": "4.0.1"
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2015-05137"
      },
      {
        "db": "BID",
        "id": "76178"
      },
      {
        "db": "BID",
        "id": "76169"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2015-004009"
      },
      {
        "db": "NVD",
        "id": "CVE-2013-7442"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201508-034"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:gehealthcare:centricity_pacs_workstation:4.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:gehealthcare:centricity_pacs_workstation:4.0.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2013-7442"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Scott Erven",
    "sources": [
      {
        "db": "BID",
        "id": "76178"
      },
      {
        "db": "BID",
        "id": "76169"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201508-034"
      }
    ],
    "trust": 1.2
  },
  "cve": "CVE-2013-7442",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "acInsufInfo": true,
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "NVD",
            "availabilityImpact": "COMPLETE",
            "baseScore": 10.0,
            "confidentialityImpact": "COMPLETE",
            "exploitabilityScore": 10.0,
            "impactScore": 10.0,
            "integrityImpact": "COMPLETE",
            "obtainAllPrivilege": false,
            "obtainOtherPrivilege": false,
            "obtainUserPrivilege": false,
            "severity": "HIGH",
            "trust": 1.0,
            "userInteractionRequired": false,
            "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
            "version": "2.0"
          },
          {
            "acInsufInfo": null,
            "accessComplexity": "Low",
            "accessVector": "Network",
            "authentication": "None",
            "author": "NVD",
            "availabilityImpact": "Complete",
            "baseScore": 10.0,
            "confidentialityImpact": "Complete",
            "exploitabilityScore": null,
            "id": "CVE-2013-7442",
            "impactScore": null,
            "integrityImpact": "Complete",
            "obtainAllPrivilege": null,
            "obtainOtherPrivilege": null,
            "obtainUserPrivilege": null,
            "severity": "High",
            "trust": 0.9,
            "userInteractionRequired": null,
            "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
            "version": "2.0"
          },
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "CNVD",
            "availabilityImpact": "COMPLETE",
            "baseScore": 10.0,
            "confidentialityImpact": "COMPLETE",
            "exploitabilityScore": 10.0,
            "id": "CNVD-2015-05137",
            "impactScore": 10.0,
            "integrityImpact": "COMPLETE",
            "severity": "HIGH",
            "trust": 0.6,
            "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
            "version": "2.0"
          }
        ],
        "cvssV3": [],
        "severity": [
          {
            "author": "NVD",
            "id": "CVE-2013-7442",
            "trust": 1.8,
            "value": "HIGH"
          },
          {
            "author": "CNVD",
            "id": "CNVD-2015-05137",
            "trust": 0.6,
            "value": "HIGH"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-201508-034",
            "trust": 0.6,
            "value": "CRITICAL"
          },
          {
            "author": "VULMON",
            "id": "CVE-2013-7442",
            "trust": 0.1,
            "value": "HIGH"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2015-05137"
      },
      {
        "db": "VULMON",
        "id": "CVE-2013-7442"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2015-004009"
      },
      {
        "db": "NVD",
        "id": "CVE-2013-7442"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201508-034"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "GE Healthcare Centricity PACS Workstation 4.0 and 4.0.1 has a password of (1) CANal1 for the Administrator user and (2) iis for the IIS user, which has unspecified impact and attack vectors related to TimbuktuPro.  NOTE: it is not clear whether this password is default, hardcoded, or dependent on another system or product that requires it. (1) For admin users CANal1 password (2) IIS For users iis password It is unknown whether this password is default, hard-coded, or dependent on other systems or products that require a fixed value.It may be subject to unspecified effects and attacks. An attacker could use this vulnerability to control the device. \nAttackers can exploit this issue to bypass the authentication mechanism and gain access to the vulnerable device",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2013-7442"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2015-004009"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2015-05137"
      },
      {
        "db": "BID",
        "id": "76178"
      },
      {
        "db": "BID",
        "id": "76169"
      },
      {
        "db": "VULMON",
        "id": "CVE-2013-7442"
      }
    ],
    "trust": 2.79
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2013-7442",
        "trust": 3.7
      },
      {
        "db": "ICS CERT",
        "id": "ICSMA-18-037-02",
        "trust": 1.9
      },
      {
        "db": "BID",
        "id": "76169",
        "trust": 1.0
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2015-004009",
        "trust": 0.8
      },
      {
        "db": "CNVD",
        "id": "CNVD-2015-05137",
        "trust": 0.6
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201508-034",
        "trust": 0.6
      },
      {
        "db": "BID",
        "id": "76178",
        "trust": 0.3
      },
      {
        "db": "VULMON",
        "id": "CVE-2013-7442",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2015-05137"
      },
      {
        "db": "VULMON",
        "id": "CVE-2013-7442"
      },
      {
        "db": "BID",
        "id": "76178"
      },
      {
        "db": "BID",
        "id": "76169"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2015-004009"
      },
      {
        "db": "NVD",
        "id": "CVE-2013-7442"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201508-034"
      }
    ]
  },
  "id": "VAR-201508-0275",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2015-05137"
      }
    ],
    "trust": 1.6
  },
  "iot_taxonomy": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "category": [
          "ICS"
        ],
        "sub_category": null,
        "trust": 0.6
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2015-05137"
      }
    ]
  },
  "last_update_date": "2023-12-18T12:07:02.927000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "Centricity PACS Workstation Installation and Service Manual (PACS 4.0 Release)",
        "trust": 0.8,
        "url": "http://apps.gehealthcare.com/servlet/clientservlet/c40_ws_inst_sv_2063534-001r2.pdf?req=raa\u0026direction=2063534-001\u0026filename=c40_ws_inst_sv_2063534-001r2.pdf\u0026filerev=1\u0026docrev_org=1"
      },
      {
        "title": "Centricity PACS Workstation Installation and Service Manual (PACS 4.0.1 Release)",
        "trust": 0.8,
        "url": "http://apps.gehealthcare.com/servlet/clientservlet/c401_ws_inst_sv_2069560001r1.pdf?req=raa\u0026direction=2069560-001\u0026filename=c401_ws_inst_sv_2069560001r1.pdf\u0026filerev=1\u0026docrev_org=1"
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2015-004009"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-255",
        "trust": 1.8
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2015-004009"
      },
      {
        "db": "NVD",
        "id": "CVE-2013-7442"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 3.7,
        "url": "http://www.forbes.com/sites/thomasbrewster/2015/07/10/vulnerable-breasts/"
      },
      {
        "trust": 2.0,
        "url": "https://ics-cert.us-cert.gov/advisories/icsma-18-037-02"
      },
      {
        "trust": 1.4,
        "url": "http://apps.gehealthcare.com/servlet/clientservlet/c401_ws_inst_sv_2069560001r1.pdf?req=raa\u0026direction=2069560-001\u0026filename=c401_ws_inst_sv_2069560001r1.pdf\u0026filerev=1\u0026docrev_org=1"
      },
      {
        "trust": 1.2,
        "url": "http://www3.gehealthcare.com/en"
      },
      {
        "trust": 1.1,
        "url": "https://twitter.com/digitalbond/status/619250429751222277"
      },
      {
        "trust": 1.1,
        "url": "http://apps.gehealthcare.com/servlet/clientservlet/c40_ws_inst_sv_2063534-001r2.pdf?req=raa\u0026direction=2063534-001\u0026filename=c40_ws_inst_sv_2063534-001r2.pdf\u0026filerev=1\u0026docrev_org=1"
      },
      {
        "trust": 0.8,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2013-7442"
      },
      {
        "trust": 0.8,
        "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2013-7442"
      },
      {
        "trust": 0.7,
        "url": "https://www.securityfocus.com/bid/76169"
      },
      {
        "trust": 0.1,
        "url": "https://cwe.mitre.org/data/definitions/255.html"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov"
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2015-05137"
      },
      {
        "db": "VULMON",
        "id": "CVE-2013-7442"
      },
      {
        "db": "BID",
        "id": "76178"
      },
      {
        "db": "BID",
        "id": "76169"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2015-004009"
      },
      {
        "db": "NVD",
        "id": "CVE-2013-7442"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201508-034"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "CNVD",
        "id": "CNVD-2015-05137"
      },
      {
        "db": "VULMON",
        "id": "CVE-2013-7442"
      },
      {
        "db": "BID",
        "id": "76178"
      },
      {
        "db": "BID",
        "id": "76169"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2015-004009"
      },
      {
        "db": "NVD",
        "id": "CVE-2013-7442"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201508-034"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2015-08-06T00:00:00",
        "db": "CNVD",
        "id": "CNVD-2015-05137"
      },
      {
        "date": "2015-08-04T00:00:00",
        "db": "VULMON",
        "id": "CVE-2013-7442"
      },
      {
        "date": "2015-08-04T00:00:00",
        "db": "BID",
        "id": "76178"
      },
      {
        "date": "2015-08-04T00:00:00",
        "db": "BID",
        "id": "76169"
      },
      {
        "date": "2015-08-06T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2015-004009"
      },
      {
        "date": "2015-08-04T14:59:23.657000",
        "db": "NVD",
        "id": "CVE-2013-7442"
      },
      {
        "date": "2015-08-05T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201508-034"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2019-11-01T00:00:00",
        "db": "CNVD",
        "id": "CNVD-2015-05137"
      },
      {
        "date": "2018-03-28T00:00:00",
        "db": "VULMON",
        "id": "CVE-2013-7442"
      },
      {
        "date": "2015-08-04T00:00:00",
        "db": "BID",
        "id": "76178"
      },
      {
        "date": "2019-04-12T17:00:00",
        "db": "BID",
        "id": "76169"
      },
      {
        "date": "2018-04-02T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2015-004009"
      },
      {
        "date": "2018-03-28T01:29:02.450000",
        "db": "NVD",
        "id": "CVE-2013-7442"
      },
      {
        "date": "2019-04-15T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201508-034"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "network",
    "sources": [
      {
        "db": "BID",
        "id": "76178"
      },
      {
        "db": "BID",
        "id": "76169"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "GE Healthcare Centricity PACS Workstation Trust Management Vulnerability",
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2015-05137"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201508-034"
      }
    ],
    "trust": 1.2
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Design Error",
    "sources": [
      {
        "db": "BID",
        "id": "76178"
      },
      {
        "db": "BID",
        "id": "76169"
      }
    ],
    "trust": 0.6
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.