Vulnerability

BD tests Windows DNS Server patch for CVE-2020-1350 on Alaris, HealthSight and Kiestra

MedDevice Cyber Staff · Sep 8 · 2 min read · Via BD bulletin: Third-Party Vulnerabilities: Windows DNS Server

BD published a third-party bulletin on September 8, 2020 for CVE-2020-1350, a remote code execution flaw in Windows DNS servers. Products in scope are Alaris Systems Maintenance, Alaris Systems Manager, FocalPoint Large Lab Server, the HealthSight suite, the Infusion, Medication and Supply Knowledge Portals, Kiestra InoqulA, ReadA, TLA and WCA, and Synapsys.

BD is testing the Microsoft patch for affected products. A DNS server role on a clinical application server is a service most of those boxes do not need, and the cheapest fix is to remove it.

Are you a representative of BD? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

BD was testing Microsoft's CVE-2020-1350 patch as of September 8, 2020. Apply it on listed BD servers once BD validates it. Where the DNS Server role is not required, removing it eliminates the exposure.

Apply the validated patch. Install Microsoft's CVE-2020-1350 fix on listed BD servers after BD clears it.
Remove unused DNS roles. Confirm with BD whether each server needs the DNS Server role and remove it where it does not.
Restrict DNS traffic. Allow DNS queries to BD servers only from hosts that need them.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Named operating system

BD Alaris Systems Manager

Named operating system

Fix the class in your product

The flaw is in the OS inside the controller, or a system past end of service still in the field. As the maker, own the embedded OS and server lifecycle as a safety obligation, design controllers to update in the field, and make every fault degrade to a defined safe state.

Own the OS lifecycle. Patch the OS and server components on a schedule with a tested delivery path.
Design for field update. And for planned replacement, so an unpatchable unit has a path off the network.
Degrade to safe. A fault drives a defined safe state, never an unexpected stop on a life-sustaining device.

Mapped EMB3D mitigations

Products potentially also affected

Products whose own public documentation shares this advisory's attributes. A shared attribute is a lead, not a finding. The status column shows only what each manufacturer has said.

Product	Manufacturer	Shared with this advisory	Manufacturer status
BD Alaris Infusion System with Guardrails Suite MX	BD	Names the affected product	No feedback feed from manufacturer

Questions & Answers

Which BD products are affected by CVE-2020-1350?

BD's September 8, 2020 bulletin lists Alaris Systems Maintenance, Alaris Systems Manager, FocalPoint Large Lab Server, HealthSight products, BD Infusion, Medication and Supply Knowledge Portals, Kiestra and Synapsys as affected by Windows DNS Server flaw CVE-2020-1350.

Has BD approved the patch for Windows DNS Server CVE-2020-1350?

As of September 8, 2020, BD was testing Microsoft's patch for CVE-2020-1350 on affected BD products. Customers should wait for BD's validated guidance per product.

← Back to Vulnerabilities