Vulnerability

Philips IntelliSpace Cardiovascular and Xcelera servers allow privilege escalation through writable executable folders

MedDevice Cyber Staff · Aug 14 · 3 min read · Via CISA ICSMA-18-226-01

CISA published advisory ICSMA-18-226-01 on August 14, 2018, on Philips IntelliSpace Cardiovascular (ISCV) 3.1 and earlier and Xcelera 4.1 and earlier. Philips reported the issue. It is CVE-2018-14789 (CWE-269), with a CVSS v3 base score of 4.2.

For ISCV 2.x or prior and Xcelera 4.1 or prior, an attacker with escalated privileges could access folders containing executables where authenticated users have write permissions. From there the attacker could run arbitrary code with local administrative permissions on the ISCV/Xcelera server.

Writable program folders are a classic swap point. Replace a binary that a privileged service or administrator later runs, and the replacement inherits those rights. The CVSS vector keeps the score low: local access, high privileges required and low impact on confidentiality, integrity and availability.

Philips mitigated the issue for ISCV 2.x in ISCV 3.1 and told users to contact their local Philips service support team for upgrade instructions. For ISCV 3.1 or prior and Xcelera 4.1 or prior, the fix was to arrive in ISCV 3.2, scheduled for October 2018, with interim mitigations recommended until then.

Install directory permissions are part of the product, and a cardiology server should ship with them already locked.

Are you a representative of Philips? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Upgrade ISCV 2.x installations to ISCV 3.1, and plan the move to ISCV 3.2 (scheduled for October 2018) for ISCV 3.1 and Xcelera 4.1 or earlier. Until then, apply Philips' interim mitigations and remove write access for ordinary users on folders that hold executables. Contact the local Philips service support team for upgrade instructions.

Upgrade to the fixed ISCV release. ISCV 3.1 mitigates CVE-2018-14789 for 2.x installs; ISCV 3.2 covers ISCV 3.1 and Xcelera 4.1 or earlier.
Audit folder permissions on the server. Find folders containing executables that authenticated users can write to and remove that access.
Limit who can log on to the server. The attack needs local access and existing privileges on the ISCV/Xcelera server, so restrict interactive accounts to administrators.
Monitor executable changes. Alert on new or modified binaries in the application folders between scheduled updates.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

User accounts

Contributing

Role-based access

IntelliSpace Cardiovascular

PID-232 User accounts Role-based access

Xcelera

PID-232 User accounts

Fix the class in your product

A standard user on the workstation becomes SYSTEM, or the client hands over stored credentials. As the maker, load libraries only from fixed trusted paths, hold short-lived tokens instead of recoverable credentials, and remove user-writable directories from any privileged search path.

Pin library load paths. Restrict the search path and load by full absolute path, never from a working directory.
Hold tokens, not passwords. Keep a short-lived token in the OS vault; store nothing reusable at rest.
Set installer ACLs. No privileged binary loads from a location a standard user can write.

Mapped EMB3D mitigations

Questions & Answers

What is CVE-2018-14789 in Philips IntelliSpace Cardiovascular?

CVE-2018-14789 (CWE-269, CVSS v3 4.2) is a privilege management flaw in Philips IntelliSpace Cardiovascular 3.1 and earlier and Xcelera 4.1 and earlier. An attacker could write to folders containing executables and then run arbitrary code with local administrative permissions, per CISA advisory ICSMA-18-226-01 of August 14, 2018.

Which IntelliSpace Cardiovascular version fixes CVE-2018-14789?

ISCV 3.1 mitigates CVE-2018-14789 for ISCV 2.x installations. For ISCV 3.1 or prior and Xcelera 4.1 or prior, Philips scheduled the fix in ISCV 3.2 for October 2018, according to CISA advisory ICSMA-18-226-01.

← Back to Vulnerabilities