Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2019.2118 Advisory (ICSMA-19-164-01) BD Alaris Gateway Workstation 14 June 2019 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: BD Alaris Gateway Workstation Publisher: ICS-CERT Operating System: Network Appliance Impact/Access: Unauthorised Access -- Remote/Unauthenticated Resolution: Patch/Upgrade CVE Names: CVE-2019-10962 CVE-2019-10959 Original Bulletin: https://ics-cert.us-cert.gov/advisories/ICSMA-19-164-01 - --------------------------BEGIN INCLUDED TEXT-------------------- Advisory (ICSMA-19-164-01) BD Alaris Gateway Workstation Original release date: June 13, 2019 Legal Notice All information products included in http://ics-cert.us-cert.gov are provided"as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see http://www.us-cert.gov/tlp/ . 1. EXECUTIVE SUMMARY o CVSS v3 10.0 o ATTENTION: Remotely exploitable/low skill level to exploit o Vendor: (BD) Becton, Dickinson and Company o Equipment: Alaris Gateway Workstation o Vulnerabilities: Improper Access Control, Unrestricted Upload of File with Dangerous Type 2. RISK EVALUATION Exploitation of these vulnerabilities could allow unauthorized arbitrary code execution, which could allow an attacker to view and edit device status and configuration details as well as cause devices to become unavailable. The vendor has stated the affected products are not sold in the United States. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS The following versions of BD's Alaris Gateway Workstation are affected: For the Alaris Gateway Workstation Web Browser User Interface vulnerability: o 1.0.13 o 1.1.3 Build 10 o 1.1.3 MR Build 11 o 1.1.5 o 1.1.6 This does not impact the latest firmware Versions 1.3.2 and 1.6.1 For the Alaris Gateway Workstation Dangerous File Upload vulnerability: o 1.1.3 Build 10 o 1.1.3 MR Build 11 o 1.2 Build 15 o 1.3.0 Build 14 o 1.3.1 Build 13 This does not impact the latest firmware Versions 1.3.2 and 1.6.1 Additionally, this notification applies to the following products using software Version 2.3.6 and below: o Alaris GS o Alaris GH o Alaris CC o Alaris TIVA Only software versions for 2.3.6 and below are impacted. Software Version 2.3.6 was released in 2006. These pumps were previously sold under the Asena brand. This does not apply to Alaris Medley devices. 3.2 VULNERABILITY OVERVIEW 3.2.1 IMPROPER ACCESS CONTROL CWE-284 The web browser user interface on the Alaris Gateway Workstation does not prevent an attacker with knowledge of the IP address of the Alaris Gateway Workstation terminal to gain access to the status and configuration information of the device. CVE-2019-10962 has been assigned to this vulnerability. A CVSS v3 base score of 7.3 has been calculated; the CVSS vector string is ( AV:N/AC:L/PR:N/UI:N/S:U/ C:L/I:L/A:L ). 3.2.2 UNRESTRICTED UPLOAD OF FILE WITH DANGEROUS TYPE CWE-434 The application does not restrict the upload of malicious files during a firmware update. CVE-2019-10959 has been assigned to this vulnerability. A CVSS v3 base score of 10.0 has been calculated; the CVSS vector string is ( AV:N/AC:L/PR:N/UI:N/S:C/ C:L/I:H/A:H ). 3.3 BACKGROUND o CRITICAL INFRASTRUCTURE SECTORS: Healthcare and Public Health o COUNTRIES/AREAS DEPLOYED: Europe, Asia o COMPANY HEADQUARTERS LOCATION: United States 3.4 RESEARCHER Elad Luz of CyberMDX reported these vulnerabilities to NCCIC. 4. MITIGATIONS BD recommends the following mitigations and compensating controls in order to reduce risk associated with these vulnerabilities. For the Alaris Gateway Workstation Web Browser User Interface vulnerability: o BD recommends using the latest firmware, Version 1.3.2 or 1.6.1 o Users should ensure only appropriate associates have access to their network o Users should isolate their network from untrusted systems For the Alaris Gateway Workstation Dangerous File Upload vulnerability: o BD recommends users block the SMB protocol o Users should segregate their VLAN network o Users should ensure only appropriate associates have access to the network. BD is currently assessing additional remediation efforts, including an adjustment to restrict the SMB protocol. For more information on BD's product security and vulnerability management, contact BD's Product Security Office at: https://www.bd.com/en-us/support/product-security-and-privacy/ product-security-bulletins NCCIC recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities. Specifically, users should: o Minimize network exposure for all medical devices and/or systems. o Locate medical devices behind firewalls and isolate them where possible. o Restrict system access to authorized personnel only and follow a least privilege approach. o Apply defense-in-depth strategies. o Disable any unnecessary accounts, protocols and services. o Where additional information is needed, refer to existing cybersecurity in medical device guidance issued by the FDA at the following location: https://www.fda.gov/MedicalDevices/DigitalHealth/ucm373213.htm NCCIC reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures. NCCIC also provides a section for control systems security recommended practices on the ICS-CERT web page. Several recommended practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies . Additional mitigation guidance and recommended practices are publicly available on the ICS-CERT website in the Technical Information Paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies . Organizations observing any suspected malicious activity should follow their established internal procedures and report their findings to NCCIC for tracking and correlation against other incidents. No known public exploits specifically target these vulnerabilities. - --------------------------END INCLUDED TEXT-------------------- You have received this e-mail bulletin as a result of your organisation's registration with AusCERT. The mailing list you are subscribed to is maintained within your organisation, so if you do not wish to continue receiving these bulletins you should contact your local IT manager. If you do not know who that is, please send an email to auscert@auscert.org.au and we will forward your request to the appropriate person. NOTE: Third Party Rights This security bulletin is provided as a service to AusCERT's members. As AusCERT did not write the document quoted above, AusCERT has had no control over its content. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the author's website to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: https://www.auscert.org.au/bulletins/ =========================================================================== Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072 Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. =========================================================================== -----BEGIN PGP SIGNATURE----- Comment: http://www.auscert.org.au/render.html?it=1967 iQIVAwUBXQL8PWaOgq3Tt24GAQhvPBAAwy3xCc49Hsq3Y6t4sbQLMfsN76CAO03l ICWWH9zh2maXeqmJWgNZURStVQyVe4zE3ZnEL/fWaf5jx+zvsqU1aDp/sW0vdoew IoWW/4gH01A8Z5Ul5ZHvoqSNuig/HR/M7tZZV9gK+F51ejhEH6yQQC5C6sfBl49m 8wciQ3ecOlOiGry+AjI6APdISEF98G5j1+OtWNEfLwFufH99Y0iwHTSU937mOeYv QEZ8SlJKa4yNp/F/XiEuXsocR/TB0fCBZYjE26TRvOdzWjFiB7N3V84WwY+IwG0f 2bBpcsUnOQNGdftdF9wetasf+/l5LnQiqLQUn2Og47YG3Gjv/r4Q1SGBKwd1lwr8 ovcdQTvd59c1fJ5iLmJ3ar1wZI37LNM5PAoXHRX7TKYkDLr8ddsS7jynGMAHnT0B TOm/u6mXhKUgySLm6T21cPt4ocF/PV/7GOwmXjpFI6LsqjNd2mwIr+pi3i6xiUmA NliXxVOZ35P2rQ4V03HdqGhFAviCSOycW4FH6ZvxFMKmqVrhh05u/OpQe3OXHq9i DnRslIhrc89u8AFUwJP83fXvYQR9i2ep3EYwM/0bL3NpMVyOZ+QqJuug036RhcGb zgSWpIa/ZG76GY25mG7/eX9g2UHD08zYK2HKfephka3FlN2eOqBNsrnoDXfx6i7k rLonIe6pyps= =fRfF -----END PGP SIGNATURE-----