Vulnerability

Philips IntelliVue Information Center iX B.02 can be knocked offline by repeated UDP requests

MedDevice Cyber Staff · Aug 21 · 3 min read · Via CISA ICSMA-18-233-01

CISA published advisory ICSMA-18-233-01 on August 21, 2018, covering the Philips IntelliVue Information Center iX (PIIC iX) version B.02. The single vulnerability, CVE-1999-0103 (CWE-400), scores 5.7 under CVSS v3. An anonymous party and Philips are credited.

An attacker can exhaust the system by sending multiple initial UDP requests. CISA's risk evaluation says the operating system becomes unresponsive under the attack, which affects the application's ability to meet its intended use. The vector requires adjacent network access and low privileges.

PIIC iX is a central monitoring station, so the clinical cost of an outage is the loss of the central view of patient monitors, not a stopped device at the bedside. The attacker has to be on the same network segment, which is exactly where a compromised workstation on a flat clinical VLAN already sits.

Philips put mitigations in place and pointed users to the device labeling, instructions for use and service guides for compensating controls. It committed to a patch for all PIIC iX B.02 users by the end of November 2018.

A CVE number from 1999 on a 2018 monitoring product says the network stack inherited old behavior nobody switched off. Close the UDP services the station does not use.

Are you a representative of Philips? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Install the Philips patch for IntelliVue Information Center iX B.02, committed for the end of November 2018. Until it lands, follow the compensating controls in the device labeling, instructions for use and service guides. Keep the station on a dedicated monitoring segment so untrusted hosts cannot reach its UDP services.

Apply the PIIC iX B.02 patch. Schedule the Philips patch with service as soon as it is released for your installation.
Follow the labeling controls. Apply the compensating controls in the PIIC iX instructions for use and service guides now.
Isolate the monitoring network. Limit adjacent access so only monitors and approved clinical hosts share the station's segment.
Filter unneeded UDP traffic. Block UDP services the station does not require at the segment boundary.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Wired network

Contributing

Hospital network Named operating system

IntelliVue Information Center iX

PID-41 Hospital network

Fix the class in your product

Malformed or excessive input pushes the service over, and on a monitor that means the screen goes dark. As the maker, validate and bound every input at the boundary, handle malformed messages as a defined error path, and watchdog the clinical display so a fault recovers to a safe view.

Validate and bound input. Enforce type, size, and rate limits; null-check before you dereference.
Fail safe. Handle malformed input as a defined error path, never an unchecked dereference.
Watchdog the display. On a monitor, restore the clinical view quickly and safely after a fault.

Mapped EMB3D mitigations

Products potentially also affected

Products whose own public documentation shares this advisory's attributes. A shared attribute is a lead, not a finding. The status column shows only what each manufacturer has said.

Product	Manufacturer	Shared with this advisory	Manufacturer status
Endoflip 300	Medtronic	Same signals	No feedback feed from manufacturer

Questions & Answers

What is CVE-1999-0103 in the Philips IntelliVue Information Center iX?

In Philips IntelliVue Information Center iX B.02, CVE-1999-0103 is uncontrolled resource consumption: multiple initial UDP requests can make the operating system unresponsive. CISA advisory ICSMA-18-233-01, published August 21, 2018, scores it 5.7 under CVSS v3.

When will Philips patch the PIIC iX B.02 denial of service?

Per CISA advisory ICSMA-18-233-01, Philips committed to a patch for all IntelliVue Information Center iX B.02 users by the end of November 2018 for CVE-1999-0103. Until then it recommends the compensating controls in the device labeling and service guides.

← Back to Vulnerabilities