Vulnerability

Philips lists IntelliVue XDS and PICiX under WinVerifyTrust signature flaw CVE-2013-3900

MedDevice Cyber Staff · May 3 · 2 min read · Via Philips product security advisories, 2023 archive

Philips published an advisory on May 3, 2023, for CVE-2013-3900, a WinVerifyTrust signature validation vulnerability that lets attackers exploit the padding of a Windows Authenticode signature to gain control of a system. Listed products are CareEvent, IntelliSpace Perinatal, IntelliVue XDS, Data Warehouse Connect, IntelliVue Guardian Software and PICiX (all versions).

Microsoft first released the vulnerability in December 2013 and recently republished guidance on its applicability to modern operating systems such as Windows 10 and 11.

A ten-year-old CVE on a 2023 applicability list shows that device patch baselines need checking against Microsoft's republished guidance as well as its monthly releases.

Are you a representative of Philips? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Microsoft's republished guidance for CVE-2013-3900 describes how to enable strict Authenticode signature checking. Apply it to the listed Philips products only as Philips validates it, and limit what software can be introduced to those hosts.

Get Philips' position. Ask Philips whether the CVE-2013-3900 hardening is validated for each listed product.
Enable strict checking. Turn on the signature padding check on validated hosts per Microsoft guidance.
Control software intake. Block users from installing or running downloaded executables on the clinical hosts.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Named operating system

CareEvent

Named operating system

IntelliSpace Perinatal

Named operating system

IntelliVue XDS

Named operating system

Data Warehouse Connect

Named operating system

IntelliVue Guardian Software

Named operating system

PICiX

Named operating system

Fix the class in your product

The flaw is in the OS inside the controller, or a system past end of service still in the field. As the maker, own the embedded OS and server lifecycle as a safety obligation, design controllers to update in the field, and make every fault degrade to a defined safe state.

Own the OS lifecycle. Patch the OS and server components on a schedule with a tested delivery path.
Design for field update. And for planned replacement, so an unpatchable unit has a path off the network.
Degrade to safe. A fault drives a defined safe state, never an unexpected stop on a life-sustaining device.

Mapped EMB3D mitigations

Questions & Answers

What is CVE-2013-3900 and does it affect Philips PICiX?

CVE-2013-3900 is a WinVerifyTrust signature validation flaw that lets attackers exploit the padding of a Windows Authenticode signature. Philips listed PICiX (all versions) and five other products on May 3, 2023.

Why did Philips issue an advisory for a 2013 Windows vulnerability?

Microsoft republished guidance on CVE-2013-3900 for modern operating systems like Windows 10 and 11, and Philips responded on May 3, 2023, listing CareEvent, IntelliSpace Perinatal, IntelliVue XDS, Data Warehouse Connect, IntelliVue Guardian Software and PICiX.

← Back to Vulnerabilities