Vulnerability

BD Kiestra PerformA and KLA Journal Service use a hard-coded database password

MedDevice Cyber Staff · Mar 23 · 2 min read · Via CISA ICSMA-17-082-01

CISA published advisory ICSMA-17-082-01 on March 23, 2017, covering a hard-coded password in two BD Kiestra lab automation applications. PerformA versions 2.0.14.0 and earlier and KLA Journal Service versions 1.0.51 and earlier use embedded passwords to reach the BD Kiestra database. The flaw is CVE-2017-6022 (CWE-259), with a CVSS v3 base score of 7.3.

Per the advisory, the passwords could be used to compromise the confidentiality of limited PHI and PII stored in the BD Kiestra database. The CVSS vector is network reachable, needs no privileges and no user interaction, and rates the confidentiality, integrity and availability impact as low.

A password compiled into an application is identical at every site that runs it. Whoever recovers it from one installation can try it against the database at every other one, and customers have no way to rotate it on their own.

BD scheduled remote updates of the affected applications between April 2017 and October 2017. Lab managers should confirm the update reached each Kiestra system instead of assuming the remote push finished. Database credentials belong in per-site configuration, generated at install.

Are you a representative of BD? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

BD scheduled remote updates of PerformA and KLA Journal Service between April 2017 and October 2017 to remove the hard-coded database password (CVE-2017-6022). Labs running PerformA 2.0.14.0 or earlier, or KLA Journal Service 1.0.51 or earlier, should confirm the update is installed. Until then, keep the Kiestra database reachable only from the systems that need it.

Confirm the BD update is installed. Check that each Kiestra system runs a version newer than PerformA 2.0.14.0 and KLA Journal Service 1.0.51.
Restrict database access. Allow connections to the BD Kiestra database only from the lab automation hosts that use it.
Watch database logins. Alert on database sessions from hosts outside the Kiestra system, since the shared password works from anywhere it reaches.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Patient or study database

Contributing

Handles patient data

PerformA

Patient or study database Handles patient data

KLA Journal Service

Patient or study database Handles patient data

Fix the class in your product

The shared secret ships in every unit, so one recovered credential is fleet-wide access. As the maker, delete embedded secrets from every artifact, provision a unique per-unit identity at manufacture, and force any default to be changed before the device is usable.

Provision a unique secret per unit. Derive it from a hardware-backed root so a dumped image unlocks nothing on another unit.
Remove credentials from shipped artifacts. Pull every secret out of the binary, installer, and app package; verify server-side against a slow hash.
Force default changes at setup. A device that runs on its shipped default should not become operational until the default is changed.

Mapped EMB3D mitigations

Products potentially also affected

Products whose own public documentation shares this advisory's attributes. A shared attribute is a lead, not a finding. The status column shows only what each manufacturer has said.

Product	Manufacturer	Shared with this advisory	Manufacturer status
Infinity CentralStation Wide	Dräger	Same property (MITRE EMB3D)PID-3321	No feedback feed from manufacturer
Dose IQ Safety Software	Baxter	Exposed to the same EMB3D threatTID-311	No feedback feed from manufacturer
BD Alaris Infusion System with Guardrails Suite MX	BD	Exposed to the same EMB3D threatTID-311	No feedback feed from manufacturer
TheraSphere 360 Y-90 Management Platform	Boston Scientific	Exposed to the same EMB3D threatTID-311	No feedback feed from manufacturer
Vscan Air	GE HealthCare	Exposed to the same EMB3D threatTID-329	No feedback feed from manufacturer
da Vinci Xi Surgical System, da Vinci X Surgical System	Intuitive	Exposed to the same EMB3D threatTID-329	No feedback feed from manufacturer
CT Collaboration Live	Philips	Exposed to the same EMB3D threatTID-311	No feedback feed from manufacturer
Image Management V15	Philips	Exposed to the same EMB3D threatTID-311	No feedback feed from manufacturer
TipTraQ	Pranaq	Exposed to the same EMB3D threatTID-329	No feedback feed from manufacturer
MOBILETT Impact	Siemens Healthineers	Exposed to the same EMB3D threatTID-311	No feedback feed from manufacturer
ART-Plan+	TheraPanacea	Exposed to the same EMB3D threatTID-329	No feedback feed from manufacturer
ARIA Radiation Therapy Management System	Varian	Exposed to the same EMB3D threatTID-311	No feedback feed from manufacturer
BlueStar and BlueStar Rx	Welldoc	Exposed to the same EMB3D threatTID-311	No feedback feed from manufacturer

Questions & Answers

What is CVE-2017-6022 in BD Kiestra PerformA and KLA Journal Service?

CVE-2017-6022 is a hard-coded password (CWE-259, CVSS v3 7.3) that BD Kiestra PerformA 2.0.14.0 and earlier and KLA Journal Service 1.0.51 and earlier use to access the BD Kiestra database, which stores limited PHI and PII. CISA disclosed it in advisory ICSMA-17-082-01 on March 23, 2017.

When did BD fix the hard-coded password in BD Kiestra PerformA?

BD scheduled remote updates for PerformA and KLA Journal Service between April 2017 and October 2017 to address CVE-2017-6022, according to CISA advisory ICSMA-17-082-01 published March 23, 2017.

← Back to Vulnerabilities

Key Facts

Product 1: PerformA 2.0.14.0 and earlier (Becton, Dickinson and Company (BD))
Device Type: Lab automation application
Product 2: KLA Journal Service 1.0.51 and earlier (Becton, Dickinson and Company (BD))
Device Type: Lab automation application
Material: BD Kiestra database all versions
Component: Generic Application
Interface: TCP
Dataflows: PerformA to BD Kiestra database using embedded password; KLA Journal Service to BD Kiestra database using embedded password
Assets: Hard-coded BD Kiestra database password (Credentials); Limited PHI and PII stored in the BD Kiestra database (Patient Data); BD remote updates of PerformA and KLA Journal Service (Software Update)
Advisory: ICSMA-17-082-01
CVE: CVE-2017-6022
CVSS: 7.3 (v3)
Severity: High
Disclosed: Mar 23, 2017
Source: CISA ICSMA-17-082-01

Sources

BD: on the record

Named in this story? File a statement, correction or update from a corporate email address. It runs under your name, as written, with a link to your advisory.

Submit an official response →

All coverage and follow: BD