Philips Vulnerability Mitigation Plan

Tuesday, August 14, 2018 @ 05:08 PM gHale

Philips has a mitigation plan to handle improper privilege management and an unquoted search path or element vulnerabilities in its IntelliSpace Cardiovascular (ISCV) products, according to a report with NCCIC.

Successful exploitation of these vulnerabilities, which Philips self-reported, could allow an attacker with local access and users privileges to the ISCV/Xcelera server to escalate privileges on the ISCV/Xcelera server and execute arbitrary code.

RELATED STORIES
Siemens Updating Fixes for OpenSSL Hole
Siemens Fixes Automation License Manager
Siemens Updates STEP 7, WinCC Holes
NetComm Fixes Wireless Router Holes

The following versions of Philips’ IntelliSpace Cardiovascular (ISCV) products, a comprehensive cardiac image and information management software, suffer from the vulnerabilities:
• IntelliSpace Cardiovascular, Version 3.1 or prior
• Xcelera Version 4.1 or prior

In one vulnerability, for ISCV Version 2.x or prior and Xcelera Version 4.1 or prior, an attacker with escalated privileges could access folders which contain executables where authenticated users have write permissions, and could then execute arbitrary code with local administrative permissions.

CVE-2018-14787 is the case number assigned to this vulnerability which has a CVSS v3 base score of 7.3.

In addition, for ISCV Version 3.1 or prior and Xcelera Version 4.1 or prior, an unquoted search path or element vulnerability has been identified, which may allow an attacker to execute arbitrary code and escalate their level of privileges.

CVE-2018-14789 is the case number assigned to this vulnerability, which has a CVSS v3 base score of 4.2.

The products see use mainly in the healthcare and public health sectors. They also see action on a global basis.

No known public exploits specifically target these vulnerabilities. However, an attacker with low skill level could leverage the vulnerabilities. These vulnerabilities are not exploitable remotely.

For ISCV Version 2.x or prior and Xcelera Version 4.1 or prior, this has been mitigated in ISCV 3.1. Users should contact their local Philips service support team of their regional service support for upgrade instructions.

For ISCV Version 3.1 or prior and Xcelera Version 4.1 or prior, this will be mitigated in ISCV Version 3.2, scheduled to be released in October 2018.

As an interim mitigation to the vulnerabilities until ISCV Version 3.2 can be applied, Netherlands-based Philips recommends users review their file permission policies and where possible restrict available permissions.

Users with questions regarding their specific IntelliSpace Cardiovascular installations are advised by Philips to contact their local Philips service support team or their regional service support. Click here for Philips contact information.

Click on the Philips product security website for the latest security information.



Leave a Reply

You must be logged in to post a comment.