Vulnerability

BD lists IE 9 to 11 workstations in scope for Internet Explorer flaw CVE-2019-1367

MedDevice Cyber Staff · Dec 20 · 2 min read · Via BD bulletin: Product Security Bulletin for Microsoft Internet Explorer CVE-2019-1367

BD published a bulletin on December 20, 2019 for CVE-2019-1367, a Microsoft Internet Explorer flaw that could allow code execution as the current user. BD lists products in scope for workstations running IE 9, 10 or 11: Accuri, Assurity Linc, BACTEC BOW, FX and FX40, COR, DataLink, EpiCenter, FocalPoint, the FACS cytometers, Influx, Knowledge Portal, Kiestra, LSR II and LSRFortessa, BD MAX, MedMined, Phoenix M50, Totalys and Viper LT.

Code running as the current user is only as contained as that user. On instrument workstations that log in as a local administrator, the gap between the two disappears. Nobody should browse the web from an instrument PC.

Are you a representative of BD? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Microsoft issued an update for CVE-2019-1367. Customers should apply it on listed BD workstations running IE 9, 10 or 11 per BD's validated guidance. Block general web browsing from instrument workstations.

Apply the IE update. Install Microsoft's fix for CVE-2019-1367 on listed BD workstations after BD clears it.
Block browsing. Prevent instrument workstations from reaching the internet through a browser.
Run as a standard user. Use non-administrator accounts for daily instrument operation.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Off-the-shelf software

BD FACS flow cytometers

Off-the-shelf software

Fix the class in your product

The flaw is in the OS inside the controller, or a system past end of service still in the field. As the maker, own the embedded OS and server lifecycle as a safety obligation, design controllers to update in the field, and make every fault degrade to a defined safe state.

Own the OS lifecycle. Patch the OS and server components on a schedule with a tested delivery path.
Design for field update. And for planned replacement, so an unpatchable unit has a path off the network.
Degrade to safe. A fault drives a defined safe state, never an unexpected stop on a life-sustaining device.

Mapped EMB3D mitigations

Questions & Answers

Which BD products are affected by Internet Explorer CVE-2019-1367?

BD's December 20, 2019 bulletin lists Accuri, Assurity Linc, BACTEC, COR, DataLink, EpiCenter, FocalPoint, FACS cytometers, Influx, Knowledge Portal, Kiestra, LSR II and LSRFortessa, BD MAX, MedMined, Phoenix M50, Totalys and Viper LT for workstations running IE 9, 10 or 11.

What can CVE-2019-1367 do on a BD workstation?

BD's December 20, 2019 bulletin says the Internet Explorer flaw CVE-2019-1367 could allow code execution as the current user on BD product workstations running IE 9, 10 or 11.

← Back to Vulnerabilities