-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                               ESB-2019.2118
         Advisory (ICSMA-19-164-01) BD Alaris Gateway Workstation
                               14 June 2019

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           BD Alaris Gateway Workstation
Publisher:         ICS-CERT
Operating System:  Network Appliance
Impact/Access:     Unauthorised Access -- Remote/Unauthenticated
Resolution:        Patch/Upgrade
CVE Names:         CVE-2019-10962 CVE-2019-10959 

Original Bulletin: 
   https://ics-cert.us-cert.gov/advisories/ICSMA-19-164-01

- --------------------------BEGIN INCLUDED TEXT--------------------

Advisory (ICSMA-19-164-01)

BD Alaris Gateway Workstation

Original release date: June 13, 2019

Legal Notice

All information products included in http://ics-cert.us-cert.gov are
provided"as is" for informational purposes only. The Department of Homeland
Security (DHS) does not provide any warranties of any kind regarding any
information contained within. DHS does not endorse any commercial product or
service, referenced in this product or otherwise. Further dissemination of this
product is governed by the Traffic Light Protocol (TLP) marking in the header.
For more information about TLP, see http://www.us-cert.gov/tlp/ .

1. EXECUTIVE SUMMARY

  o CVSS v3 10.0
  o ATTENTION: Remotely exploitable/low skill level to exploit
  o Vendor: (BD) Becton, Dickinson and Company
  o Equipment: Alaris Gateway Workstation
  o Vulnerabilities: Improper Access Control, Unrestricted Upload of File with
    Dangerous Type

2. RISK EVALUATION

Exploitation of these vulnerabilities could allow unauthorized arbitrary code
execution, which could allow an attacker to view and edit device status and
configuration details as well as cause devices to become unavailable. The
vendor has stated the affected products are not sold in the United States.

3. TECHNICAL DETAILS

3.1 AFFECTED PRODUCTS

The following versions of BD's Alaris Gateway Workstation are affected:

For the Alaris Gateway Workstation Web Browser User Interface vulnerability:

  o 1.0.13
  o 1.1.3 Build 10
  o 1.1.3 MR Build 11
  o 1.1.5
  o 1.1.6

This does not impact the latest firmware Versions 1.3.2 and 1.6.1

For the Alaris Gateway Workstation Dangerous File Upload vulnerability:

  o 1.1.3 Build 10
  o 1.1.3 MR Build 11
  o 1.2 Build 15
  o 1.3.0 Build 14
  o 1.3.1 Build 13

This does not impact the latest firmware Versions 1.3.2 and 1.6.1

Additionally, this notification applies to the following products using
software Version 2.3.6 and below:

  o Alaris GS
  o Alaris GH
  o Alaris CC
  o Alaris TIVA

Only software versions for 2.3.6 and below are impacted. Software Version 2.3.6
was released in 2006. These pumps were previously sold under the Asena brand.
This does not apply to Alaris Medley devices.

3.2 VULNERABILITY OVERVIEW

3.2.1 IMPROPER ACCESS CONTROL CWE-284

The web browser user interface on the Alaris Gateway Workstation does not
prevent an attacker with knowledge of the IP address of the Alaris Gateway
Workstation terminal to gain access to the status and configuration information
of the device.

CVE-2019-10962 has been assigned to this vulnerability. A CVSS v3 base score of
7.3 has been calculated; the CVSS vector string is ( AV:N/AC:L/PR:N/UI:N/S:U/
C:L/I:L/A:L ).

3.2.2 UNRESTRICTED UPLOAD OF FILE WITH DANGEROUS TYPE CWE-434

The application does not restrict the upload of malicious files during a
firmware update.

CVE-2019-10959 has been assigned to this vulnerability. A CVSS v3 base score of
10.0 has been calculated; the CVSS vector string is ( AV:N/AC:L/PR:N/UI:N/S:C/
C:L/I:H/A:H ).

3.3 BACKGROUND

  o CRITICAL INFRASTRUCTURE SECTORS: Healthcare and Public Health
  o COUNTRIES/AREAS DEPLOYED: Europe, Asia
  o COMPANY HEADQUARTERS LOCATION: United States

3.4 RESEARCHER

Elad Luz of CyberMDX reported these vulnerabilities to NCCIC.

4. MITIGATIONS

BD recommends the following mitigations and compensating controls in order to
reduce risk associated with these vulnerabilities.

For the Alaris Gateway Workstation Web Browser User Interface vulnerability:

  o BD recommends using the latest firmware, Version 1.3.2 or 1.6.1
  o Users should ensure only appropriate associates have access to their
    network
  o Users should isolate their network from untrusted systems

For the Alaris Gateway Workstation Dangerous File Upload vulnerability:

  o BD recommends users block the SMB protocol
  o Users should segregate their VLAN network
  o Users should ensure only appropriate associates have access to the network.

BD is currently assessing additional remediation efforts, including an
adjustment to restrict the SMB protocol.

For more information on BD's product security and vulnerability management,
contact BD's Product Security Office at:

https://www.bd.com/en-us/support/product-security-and-privacy/
product-security-bulletins

NCCIC recommends users take defensive measures to minimize the risk of
exploitation of these vulnerabilities. Specifically, users should:

  o Minimize network exposure for all medical devices and/or systems.
  o Locate medical devices behind firewalls and isolate them where possible.
  o Restrict system access to authorized personnel only and follow a least
    privilege approach.
  o Apply defense-in-depth strategies.
  o Disable any unnecessary accounts, protocols and services.
  o Where additional information is needed, refer to existing cybersecurity in
    medical device guidance issued by the FDA at the following location:

https://www.fda.gov/MedicalDevices/DigitalHealth/ucm373213.htm

NCCIC reminds organizations to perform proper impact analysis and risk
assessment prior to deploying defensive measures.

NCCIC also provides a section for control systems security recommended
practices on the ICS-CERT web page. Several recommended practices are available
for reading and download, including Improving Industrial Control Systems
Cybersecurity with Defense-in-Depth Strategies .

Additional mitigation guidance and recommended practices are publicly available
on the ICS-CERT website in the Technical Information Paper,
ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation
Strategies .

Organizations observing any suspected malicious activity should follow their
established internal procedures and report their findings to NCCIC for tracking
and correlation against other incidents.

No known public exploits specifically target these vulnerabilities.

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        https://www.auscert.org.au/bulletins/

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBXQL8PWaOgq3Tt24GAQhvPBAAwy3xCc49Hsq3Y6t4sbQLMfsN76CAO03l
ICWWH9zh2maXeqmJWgNZURStVQyVe4zE3ZnEL/fWaf5jx+zvsqU1aDp/sW0vdoew
IoWW/4gH01A8Z5Ul5ZHvoqSNuig/HR/M7tZZV9gK+F51ejhEH6yQQC5C6sfBl49m
8wciQ3ecOlOiGry+AjI6APdISEF98G5j1+OtWNEfLwFufH99Y0iwHTSU937mOeYv
QEZ8SlJKa4yNp/F/XiEuXsocR/TB0fCBZYjE26TRvOdzWjFiB7N3V84WwY+IwG0f
2bBpcsUnOQNGdftdF9wetasf+/l5LnQiqLQUn2Og47YG3Gjv/r4Q1SGBKwd1lwr8
ovcdQTvd59c1fJ5iLmJ3ar1wZI37LNM5PAoXHRX7TKYkDLr8ddsS7jynGMAHnT0B
TOm/u6mXhKUgySLm6T21cPt4ocF/PV/7GOwmXjpFI6LsqjNd2mwIr+pi3i6xiUmA
NliXxVOZ35P2rQ4V03HdqGhFAviCSOycW4FH6ZvxFMKmqVrhh05u/OpQe3OXHq9i
DnRslIhrc89u8AFUwJP83fXvYQR9i2ep3EYwM/0bL3NpMVyOZ+QqJuug036RhcGb
zgSWpIa/ZG76GY25mG7/eX9g2UHD08zYK2HKfephka3FlN2eOqBNsrnoDXfx6i7k
rLonIe6pyps=
=fRfF
-----END PGP SIGNATURE-----