Vulnerability

Philips IntelliSpace Perinatal K and prior lets users break out of the application to Windows

MedDevice Cyber Staff · Oct 24 · 3 min read · Via CISA ICSMA-19-297-01

CISA published advisory ICSMA-19-297-01 on October 24, 2019, covering Philips IntelliSpace Perinatal versions K and prior. Brian Landrum of Coalfire LABS reported the flaw, tracked as CVE-2019-13546 (CWE-668) with a CVSS v3 score of 6.1.

The weakness is an application breakout. An unauthorized attacker with physical access to a locked application screen, or an authorized remote desktop session host user, can escape the containment of the application and reach Windows resources as the limited-access Windows user. CISA warns that Windows vulnerabilities may then allow privilege escalation on the operating system.

Exploitation can mean executing software and viewing or updating files, directories or system configuration. Sites that installed the Document Export (DOX) function on the application server also put PHI in reach.

Philips published mitigation guidance on its InCenter portal, committed to updating the product documentation, and said it would assess further remediation in the next minor product update, planned for the end of 2020. A locked screen on a shared clinical workstation is a control the attacker is standing in front of, so harden the Windows account beneath it.

Are you a representative of Philips? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

No product fix shipped with ICSMA-19-297-01; Philips planned to assess remediation in a minor update for the end of 2020. Apply the Philips mitigation guidance on InCenter now, restrict the Windows account the application runs under, and limit physical and remote desktop access to IntelliSpace Perinatal workstations.

Apply the InCenter guidance. Follow the Philips mitigations for IntelliSpace Perinatal K and prior published on InCenter.
Lock down the Windows user. Keep the limited-access Windows account minimal and patch the operating system so a breakout cannot escalate.
Restrict remote desktop access. Limit which users can open remote desktop sessions to the application host.
Review DOX exposure. If Document Export is installed on the application server, treat that server as holding PHI.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Named operating system

Contributing

Remote access Handles patient data Hospital network

IntelliSpace Perinatal

PID-23221 Named operating system Remote access Handles patient data

Fix the class in your product

A standard user on the workstation becomes SYSTEM, or the client hands over stored credentials. As the maker, load libraries only from fixed trusted paths, hold short-lived tokens instead of recoverable credentials, and remove user-writable directories from any privileged search path.

Pin library load paths. Restrict the search path and load by full absolute path, never from a working directory.
Hold tokens, not passwords. Keep a short-lived token in the OS vault; store nothing reusable at rest.
Set installer ACLs. No privileged binary loads from a location a standard user can write.

Mapped EMB3D mitigations

Questions & Answers

What is CVE-2019-13546 in Philips IntelliSpace Perinatal?

CVE-2019-13546 lets an attacker with physical access to a locked IntelliSpace Perinatal screen, or an authorized remote desktop user, break out of the application and access Windows resources as the limited-access Windows user. CISA advisory ICSMA-19-297-01, published October 24, 2019, scores it 6.1 and lists versions K and prior.

Does the Philips IntelliSpace Perinatal breakout expose patient data?

Per CISA advisory ICSMA-19-297-01, if the Document Export (DOX) function is installed on the IntelliSpace Perinatal application server, information at risk from CVE-2019-13546 may include protected health information. Philips planned further remediation in a minor update for the end of 2020.

← Back to Vulnerabilities