Vulnerability

BD lists Pyxis and Alaris servers on VMware ESXi as affected by CVE-2020-3957 to 3959

MedDevice Cyber Staff · Aug 31 · 2 min read · Via BD bulletin: Product Security Bulletin for Third-Party VMware Vulnerabilities

BD published a bulletin on August 31, 2020 for third-party VMware vulnerabilities CVE-2020-3957, CVE-2020-3958 and CVE-2020-3959, which could affect BD products that use VMware ESXi. The products are Alaris Systems Manager Server, Pyxis IV Prep, Pyxis Logistics Server, Pyxis MedStation 4000, Pyxis Enterprise Server and Pyxis SupplyStation.

BD has received no reports of exploitation on its products. The hypervisor is shared infrastructure, so these servers carry the patch posture of whoever runs the host.

Are you a representative of BD? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

BD's August 31, 2020 bulletin ties CVE-2020-3957 to 3959 to BD products running on VMware ESXi. Hospitals should apply VMware's fixes to the hosts per BD guidance. Restrict who can run code inside guests on those hosts.

Patch ESXi hosts. Apply VMware's updates for CVE-2020-3957, CVE-2020-3958 and CVE-2020-3959 on hosts running listed BD servers.
Limit guest access. Restrict interactive logins on BD guest VMs to named administrators.
Own the host. Assign clear patch ownership for the hypervisor under each BD deployment.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Off-the-shelf software

Pyxis server products

PID-242 Off-the-shelf software

BD Alaris Systems Manager Server

PID-242

Fix the class in your product

The advisory is not for a bug you wrote; it is in a component you embed. As the maker, pin dependencies to fixed versions, generate an SBOM on every build including transitive components, and gate the pipeline on known-vulnerable components so an advisory maps to your products automatically.

Pin and inventory. Exact versions, and a CycloneDX or SPDX SBOM as a build artifact including transitive deps.
Gate on advisories. A CI scan fails a release carrying a component with a known advisory.
Own the field patch path. Know how you deliver a dependency or platform patch to fielded devices before you need it.

Mapped EMB3D mitigations

Questions & Answers

Which BD products use VMware ESXi affected by CVE-2020-3957?

BD's August 31, 2020 bulletin lists Alaris Systems Manager Server, Pyxis IV Prep, Pyxis Logistics Server, Pyxis MedStation 4000, Pyxis Enterprise Server and Pyxis SupplyStation as BD products using VMware ESXi that could be affected by CVE-2020-3957, CVE-2020-3958 and CVE-2020-3959.

Have the VMware CVE-2020-3957 flaws been exploited on BD products?

BD's August 31, 2020 bulletin says BD has received no reports of exploitation of CVE-2020-3957, CVE-2020-3958 or CVE-2020-3959 on its products.

← Back to Vulnerabilities