Vulnerability

Carestream lists Windows 10 based imaging products as affected by CurveBall CryptoAPI flaw

MedDevice Cyber Staff · Jan 17 · 2 min read · Via Carestream advisory CARESTREAM-2020-01

Carestream Health published advisory CARESTREAM-2020-01 on January 17, 2020, covering CVE-2020-0601, the Windows CryptoAPI elliptic curve certificate spoofing flaw known as CurveBall. Products running Windows 10, Server 2016 and Server 2019 are affected.

The named list includes the OnSight 3D Extremity System with ImageView v1.1, the DRX Revolution and Plus, DRX-1 Revolution Nano, DRX Evolution and Plus, DRX Transportable and DRX-1 In-Room with ImageView 1.2 to 1.6 on Windows 10 1607 LTSB, plus ImageSuite and Kiosk products. Carestream says existing controls mitigate the flaw on ImageView, and Microsoft patches were scheduled for February and March 2020.

CurveBall lets a forged certificate pass as trusted, which breaks code signing and TLS checks on the host. An imaging console that trusts a spoofed signature will install whatever arrives with one.

Are you a representative of Carestream Health? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Carestream relies on existing controls on ImageView systems and scheduled the Microsoft patches for CVE-2020-0601 in February and March 2020. Apply the validated Windows update on every listed product as it is released and confirm the controls hold until then.

Find Windows 10 hosts. Identify every Carestream product on Windows 10, Server 2016 or Server 2019, including ImageSuite and Kiosk installs.
Apply the validated patch. Install the Microsoft CurveBall update on the schedule Carestream validated for each product.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Named operating system

ImageView

PID-23 Named operating system

Fix the class in your product

The flaw is in the OS inside the controller, or a system past end of service still in the field. As the maker, own the embedded OS and server lifecycle as a safety obligation, design controllers to update in the field, and make every fault degrade to a defined safe state.

Own the OS lifecycle. Patch the OS and server components on a schedule with a tested delivery path.
Design for field update. And for planned replacement, so an unpatchable unit has a path off the network.
Degrade to safe. A fault drives a defined safe state, never an unexpected stop on a life-sustaining device.

Mapped EMB3D mitigations

Products potentially also affected

Products whose own public documentation shares this advisory's attributes. A shared attribute is a lead, not a finding. The status column shows only what each manufacturer has said.

Product	Manufacturer	Shared with this advisory	Manufacturer status
Infinity Gateway Suite	Dräger	Same named componentWindows Server (= 2016)	No feedback feed from manufacturer
Harmony Referral System	Topcon Healthcare	Same named componentWindows Server (= 2016)	No feedback feed from manufacturer

Questions & Answers

Which Carestream products are affected by CVE-2020-0601 CurveBall?

Carestream advisory CARESTREAM-2020-01, published January 17, 2020, lists products on Windows 10, Server 2016 and Server 2019, including OnSight 3D Extremity System ImageView v1.1, DRX systems with ImageView 1.2 to 1.6, and ImageSuite and Kiosk products.

Is there a patch for CurveBall on Carestream ImageView systems?

Carestream advisory CARESTREAM-2020-01 states existing controls mitigate CVE-2020-0601 on ImageView systems, with Microsoft patches scheduled for February and March 2020.

← Back to Vulnerabilities