Vulnerability

BD lists Pyxis, Alaris and lab systems in scope for DejaBlue Remote Desktop flaws

MedDevice Cyber Staff · Oct 30 · 3 min read · Via BD bulletin: Product Security Bulletin for DejaBlue

BD published a bulletin on October 30, 2019 for the DejaBlue Remote Desktop Services remote code execution vulnerabilities, CVE-2019-1181 and CVE-2019-1182. BD lists products that run Remote Desktop Services on affected Windows versions.

The products are BD EpiCenter, BACTEC BOW, BD MAX, Assurity Linc, the COR system, Pyxis MedStation ES, Pyxis SupplyStation, Pyxis IV Prep, Pyxis Logistics and Alaris Systems Manager.

BD recommends applying Microsoft's patches and enabling Network Level Authentication. Both flaws are reachable before authentication, which is why Network Level Authentication helps: it forces a login before the vulnerable code runs.

Pre-authentication bugs in a remote access service are the ones that spread on their own. On a clinical network, that means one unpatched cabinet server can reach the next.

Are you a representative of BD? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

BD recommends Microsoft's patches for CVE-2019-1181 and CVE-2019-1182 and Network Level Authentication, per its October 30, 2019 bulletin. Apply both on every listed system. Block Remote Desktop from networks that have no reason to reach these servers.

Patch Remote Desktop Services. Install Microsoft's DejaBlue fixes on listed BD systems per BD guidance.
Enable Network Level Authentication. Turn on NLA so a login is required before the RDP session is set up.
Restrict RDP reach. Limit Remote Desktop to BD systems from a managed jump host only.
Disable RDP where unused. Turn off Remote Desktop Services on systems that do not need remote sessions.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Remote access Named operating system

BD Pyxis

Remote access Named operating system

Fix the class in your product

The flaw is in the OS inside the controller, or a system past end of service still in the field. As the maker, own the embedded OS and server lifecycle as a safety obligation, design controllers to update in the field, and make every fault degrade to a defined safe state.

Own the OS lifecycle. Patch the OS and server components on a schedule with a tested delivery path.
Design for field update. And for planned replacement, so an unpatchable unit has a path off the network.
Degrade to safe. A fault drives a defined safe state, never an unexpected stop on a life-sustaining device.

Mapped EMB3D mitigations

Products potentially also affected

Products whose own public documentation shares this advisory's attributes. A shared attribute is a lead, not a finding. The status column shows only what each manufacturer has said.

Product	Manufacturer	Shared with this advisory	Manufacturer status
BD Alaris Infusion System with Guardrails Suite MX	BD	Names the affected product	No feedback feed from manufacturer

Questions & Answers

Which BD products are affected by DejaBlue?

BD's October 30, 2019 bulletin lists BD EpiCenter, BACTEC BOW, BD MAX, Assurity Linc, COR, Pyxis MedStation ES, Pyxis SupplyStation, Pyxis IV Prep, Pyxis Logistics and Alaris Systems Manager as running Remote Desktop Services affected by CVE-2019-1181 and CVE-2019-1182.

What does BD recommend for the DejaBlue vulnerabilities?

BD's October 30, 2019 bulletin recommends applying Microsoft's patches for CVE-2019-1181 and CVE-2019-1182 and enabling Network Level Authentication on affected BD products.

← Back to Vulnerabilities