Vulnerability

Natus Xltek NeuroWorks 8 has eight packet parsing flaws, three scored 10.0

MedDevice Cyber Staff · Jun 14 · 3 min read · Via CISA ICSMA-18-165-01

CISA published advisory ICSMA-18-165-01 on June 14, 2018, for Natus Xltek NeuroWorks 8. Cory Duplantis of Cisco Talos found eight vulnerabilities, each triggered by a specially crafted packet sent to the product.

Four are stack-based buffer overflows (CWE-121). CVE-2017-2853, CVE-2017-2868 and CVE-2017-2869 score CVSS v3 10.0, and CVE-2017-2867 scores 9.0. One overflow fires while the product opens a file requested by the client; others come from the way the program parses data structures. The remaining four, CVE-2017-2852, CVE-2017-2858, CVE-2017-2860 and CVE-2017-2861, are out-of-bounds reads (CWE-125, CVSS 7.5) that crash the software.

A 10.0 with no privileges and no user interaction means anyone who can reach the service can try to take control of the program. CISA notes that exploitation requires access to the Natus customer network, which narrows the attacker pool to whoever is already inside the hospital perimeter.

Natus released NeuroWorks/SleepWorks 8.5 GMA 3 with security enhancements. The update is free for users on Version 8.0, 8.1, 8.4 or 8.5, and Natus recommends installing it as quickly as possible.

Clinical review software that listens on the network deserves the same input fuzzing as a public web server. Eight packet bugs in one release point to parsers that never met a fuzzer.

Are you a representative of Natus Medical? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Upgrade to NeuroWorks/SleepWorks 8.5 GMA 3, a free update for Version 8.0, 8.1, 8.4 and 8.5 users, as quickly as possible. Until then, limit which hosts can reach NeuroWorks on the customer network, since exploitation needs network access.

Install 8.5 GMA 3. Contact Natus Neuro Technical support for the free NeuroWorks/SleepWorks 8.5 GMA 3 update.
Restrict network reach. Allow only the workstations that need NeuroWorks to connect to it until the update is in.
Fuzz the network parser. Test every packet handler with malformed input before release; four of these bugs are classic stack overflows.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Hospital network

Contributing

Physiological waveform processing Wired network

Xltek NeuroWorks

PID-41 Hospital network

Fix the class in your product

A crafted file drives the parser out of bounds. As the maker, validate every length and offset against the real buffer before you copy, decode in a sandboxed least-privilege process, and fuzz the path continuously so the next bug is yours to find.

Bound every copy. Check declared sizes against allocated buffers before memcpy; prefer memory-safe parsers for new work.
Sandbox the decoder. Run it least-privilege and isolated so a crash or exploit is contained, not privileged.
Fuzz as a release gate. Run malformed-input fuzzing on every file-format parser before shipping.

Mapped EMB3D mitigations

Products potentially also affected

Products whose own public documentation shares this advisory's attributes. A shared attribute is a lead, not a finding. The status column shows only what each manufacturer has said.

Product	Manufacturer	Shared with this advisory	Manufacturer status
EnSite Precision Cardiac Mapping System v2.6	Abbott	Same signals	No feedback feed from manufacturer
WAVE Clinical Platform	Baxter	Same signals	No feedback feed from manufacturer
CARESCAPE B650, E-musb	GE HealthCare	Same signals	No feedback feed from manufacturer
Monitor B125, Monitor B105	GE HealthCare	Same signals	No feedback feed from manufacturer
Next Generation NetKonnect	Nihon Kohden	Same signals	No feedback feed from manufacturer

Questions & Answers

What vulnerabilities affect Natus Xltek NeuroWorks 8?

CISA advisory ICSMA-18-165-01, published June 14, 2018, lists eight flaws in Natus Xltek NeuroWorks 8: stack-based buffer overflows CVE-2017-2853, CVE-2017-2867, CVE-2017-2868 and CVE-2017-2869 (CVSS up to 10.0), and out-of-bounds reads CVE-2017-2852, CVE-2017-2858, CVE-2017-2860 and CVE-2017-2861 (CVSS 7.5).

Which NeuroWorks version fixes CVE-2017-2868?

Natus NeuroWorks/SleepWorks 8.5 GMA 3 fixes CVE-2017-2868 and the other seven flaws in CISA advisory ICSMA-18-165-01. The update is free for users on NeuroWorks/SleepWorks Version 8.0, 8.1, 8.4 or 8.5.

Who discovered the Natus NeuroWorks buffer overflows?

Cory Duplantis of Cisco Talos reported the eight Natus Xltek NeuroWorks 8 vulnerabilities disclosed in CISA advisory ICSMA-18-165-01 on June 14, 2018.

← Back to Vulnerabilities