Vulnerability

Change Healthcare, McKesson and Horizon Cardiology installs ship with insecure file permissions

MedDevice Cyber Staff · Aug 29 · 2 min read · Via CISA ICSMA-19-241-01

CISA published advisory ICSMA-19-241-01 on August 29, 2019, covering CVE-2018-18630 in Change Healthcare's cardiology software. Affected are Change Healthcare Cardiology 14.1.x, McKesson Cardiology 13.x and 14.x, Horizon Cardiology 12.x and Horizon Cardiology 11.x and prior. Alfonso Powers and Bradley Shubin of Asante Information Security reported it.

The weakness is incorrect default permissions (CWE-276), scored 7.8 under CVSS v3. Insecure file permissions in the default installation let an attacker with local system access insert specially crafted files and execute arbitrary code.

The attacker needs a local account with low privileges, and nothing more. Any user with a login on the host clears that bar, and the crafted files then run as code.

Change Healthcare asks users of the affected versions to contact its support team as soon as possible to arrange installation of the supplied patch. A default install whose program folders any user can write is effectively a code execution feature.

Are you a representative of Change Healthcare? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Change Healthcare has a patch for CVE-2018-18630 and installs it through Change Healthcare Support. Sites running Change Healthcare Cardiology 14.1.x, McKesson Cardiology 13.x or 14.x, or Horizon Cardiology 12.x or earlier should book the installation now. Until then, limit local logins on the hosts.

Arrange the patch with Change Healthcare Support. The vendor installs the supplied patch for the affected Cardiology, McKesson Cardiology and Horizon Cardiology versions.
Limit local accounts on the hosts. Exploitation needs a local login, so remove accounts that do not need access to the cardiology servers and workstations.
Ship least-privilege install permissions. Software makers should make program and configuration folders writable only by administrators and the service account.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

User accounts

Change Healthcare Cardiology

User accounts

McKesson Cardiology

User accounts

Horizon Cardiology

User accounts

Fix the class in your product

A standard user on the workstation becomes SYSTEM, or the client hands over stored credentials. As the maker, load libraries only from fixed trusted paths, hold short-lived tokens instead of recoverable credentials, and remove user-writable directories from any privileged search path.

Pin library load paths. Restrict the search path and load by full absolute path, never from a working directory.
Hold tokens, not passwords. Keep a short-lived token in the OS vault; store nothing reusable at rest.
Set installer ACLs. No privileged binary loads from a location a standard user can write.

Mapped EMB3D mitigations

Questions & Answers

What is CVE-2018-18630 in McKesson Cardiology and Horizon Cardiology?

CVE-2018-18630 (CVSS 7.8) is insecure file permissions in the default installation of Change Healthcare Cardiology 14.1.x, McKesson Cardiology 13.x and 14.x, and Horizon Cardiology 12.x and 11.x and prior. A locally authenticated user could insert crafted files and run arbitrary code. CISA covered it in ICSMA-19-241-01 on August 29, 2019.

Is there a patch for CVE-2018-18630 in Change Healthcare Cardiology?

Yes. Change Healthcare supplies a patch for CVE-2018-18630 and recommends users of Change Healthcare Cardiology, McKesson Cardiology and Horizon Cardiology contact Change Healthcare Support as soon as possible to arrange installation, per CISA advisory ICSMA-19-241-01.

← Back to Vulnerabilities