Vulnerability

BD Alaris Gateway Workstation accepts malicious files during firmware update

MedDevice Cyber Staff · Jun 13 · 3 min read · Via CISA ICSMA-19-164-01

CISA published advisory ICSMA-19-164-01 on June 13, 2019, for the BD Alaris Gateway Workstation. Elad Luz of CyberMDX reported two vulnerabilities. BD told CISA the affected products are not sold in the United States.

CVE-2019-10959 (CWE-434) carries the maximum CVSS v3 score of 10.0. The application does not restrict the upload of malicious files during a firmware update, and the vector needs no privileges and no user interaction. It affects firmware 1.0.13, 1.1.3 Build 10, 1.1.3 MR Build 11, 1.1.5, 1.1.6, 1.3.0 Build 14 and 1.3.1 Build 13.

CVE-2019-10962 (CWE-284, CVSS v3 7.3) sits in the browser interface. Anyone who knows the workstation's IP address can read its status and configuration without logging in. CISA lists Alaris GS, GH, CC and TIVA software at 2.3.6 and below under this advisory as well.

CISA's risk summary says exploitation could allow arbitrary code execution, viewing and editing of device status and configuration, and making devices unavailable. The changed scope in the 10.0 vector reflects that a compromise of the workstation reaches beyond the workstation itself.

BD published separate compensating controls for the web interface and the file upload issue and said it was assessing further work, including restricting the SMB protocol. The CVE descriptions in the advisory do not list a fixed firmware build.

A firmware update path that takes any file from the network is the same thing as a remote shell. Signature checks on update packages belong in the first release, not a later bulletin.

Are you a representative of BD? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Apply BD's compensating controls for both the web interface and the firmware upload issue from its product security bulletin, since the advisory names no fixed firmware build. Segment Alaris Gateway Workstations so only named clinical engineering hosts can reach them, and block SMB to them. Follow BD's further remediation work as it lands.

Apply BD's controls. Follow the BD bulletin guidance for the web browser interface and the dangerous file upload vulnerability on every workstation.
Segment the workstations. Put Alaris Gateway Workstations on a restricted VLAN reachable only from clinical engineering hosts.
Block SMB. Deny SMB to the workstations from general hospital networks while BD assesses its own SMB restriction.
Sign firmware in design. Accept only cryptographically signed firmware packages and reject everything else before it is written.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Field-updatable firmware

Contributing

Web interface Hospital network Therapy delivery

Alaris Gateway Workstation

PID-311 PID-271 Web interface Field-updatable firmware

Fix the class in your product

The server accepts an uploaded file and lets it execute. As the maker, validate type by content, store uploads under a server-generated name in a non-executable location outside the web root, and serve them back through a handler that never interprets them.

Validate by content. Check magic bytes, not the extension; cap size and scan on ingest.
Store inert and non-executable. Server-generated name, no-exec directory, outside the web root.
Never execute an upload. Serve through a handler that returns bytes, never interprets them.

Mapped EMB3D mitigations

Questions & Answers

What is CVE-2019-10959 in the BD Alaris Gateway Workstation?

CVE-2019-10959 is an unrestricted upload of dangerous file types during firmware update (CWE-434, CVSS v3 10.0) in BD Alaris Gateway Workstation firmware 1.0.13 through 1.3.1 Build 13. CISA disclosed it in advisory ICSMA-19-164-01 on June 13, 2019, crediting Elad Luz of CyberMDX.

Can anyone view BD Alaris Gateway Workstation settings without a password?

Yes, per CVE-2019-10962 (CVSS v3 7.3) in CISA advisory ICSMA-19-164-01: the Alaris Gateway Workstation browser interface lets anyone who knows its IP address view status and configuration information.

Is the BD Alaris Gateway Workstation sold in the US?

BD stated that the Alaris Gateway Workstation versions in CISA advisory ICSMA-19-164-01, affected by CVE-2019-10959 and CVE-2019-10962, are not sold in the United States.

← Back to Vulnerabilities