Vulnerability

Change Healthcare PeerVue Web Server leaks technical details in HTTP error messages

MedDevice Cyber Staff · Oct 4 · 2 min read · Via CISA ICSMA-18-277-02

CISA published advisory ICSMA-18-277-02 on October 4, 2018, covering one vulnerability in the Change Healthcare PeerVue Web Server, versions before 7.6.2. Dan Regalado of Zingbox reported it.

CVE-2018-10624 is generation of an error message containing sensitive information (CWE-209), with a CVSS v3 base score of 4.3. Improper error handling in HTTP-based communications with the server can hand an attacker technical information about the system. The vector requires adjacent network access and no privileges, and the impact is limited to low confidentiality.

A verbose error is reconnaissance. Stack traces, component names and version strings tell an attacker which known flaws to try next, which is why CISA's risk evaluation frames the issue as information that lets an attacker target a system for attack.

Change Healthcare released a patch, and CISA described the company as very responsive in mitigating the issue. Users get the patch through the Change Healthcare support team. Production servers should return generic errors and keep the detail in their own logs.

Are you a representative of Change Healthcare? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Contact Change Healthcare support for the patch that fixes CVE-2018-10624 in PeerVue Web Server versions before 7.6.2. Until it is installed, limit which hosts can reach the server, since the flaw needs adjacent network access. Configure production web servers to return generic error pages.

Request the patch. Contact the Change Healthcare support team for the PeerVue Web Server patch for CVE-2018-10624.
Restrict network reach. Allow only the workstations that need PeerVue to connect to the web server.
Suppress detailed errors. Return generic error pages to clients and write stack traces and version details to server logs only.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Web interface

PeerVue Web Server

PID-311 Web interface

Fix the class in your product

The product exposes an interface with authentication off out of the box. As the maker, make the default configuration the secure configuration: require an admin credential before any interface serves data, and refuse to expose anything until setup is complete.

Default to authenticated. Block every data path until an admin credential is set on first boot.
Make insecure mode explicit. If an open mode must exist, it is a loud, logged, opt in choice, never the starting state.
Test the out of box state. Treat the shipped default as its own threat model.

Mapped EMB3D mitigations

Products potentially also affected

Products whose own public documentation shares this advisory's attributes. A shared attribute is a lead, not a finding. The status column shows only what each manufacturer has said.

Product	Manufacturer	Shared with this advisory	Manufacturer status
Assert-IQ (DM5000)	Abbott	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
Novum IQ Large Volume Pump	Baxter	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
WAVE Clinical Platform	Baxter	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
BD Phoenix Automated Microbiology System	BD	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
LUX-Dx II (M302); LUX-Dx II+	Boston Scientific	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
Image Suite	Carestream Health	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
Dexcom Smart Basal	DexCom	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
aPROMISE	Exini Diagnostics	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
Synapse PACS	Fujifilm Healthcare	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
Universal Viewer	GE HealthCare	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
Vscan Air	GE HealthCare	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
Heartvue.Proton	HeartVue	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
Aperio GT 450 DX	Leica Biosystems	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
Novo	PathAI	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
aetherSlide	Philips	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer

26 more products match. Each manufacturer page lists its products and the advisories they share attributes with.

Questions & Answers

What is CVE-2018-10624 in Change Healthcare PeerVue Web Server?

CVE-2018-10624 is an information exposure through error messages (CWE-209, CVSS v3 4.3) in Change Healthcare PeerVue Web Server versions before 7.6.2. Improper error handling in HTTP communications can reveal technical information about the server. CISA published it in advisory ICSMA-18-277-02 on October 4, 2018.

How do I get the PeerVue Web Server patch for CVE-2018-10624?

Change Healthcare released a patch for CVE-2018-10624 in PeerVue Web Server versions before 7.6.2, and users obtain it by contacting the Change Healthcare support team, according to CISA advisory ICSMA-18-277-02 published October 4, 2018.

← Back to Vulnerabilities