Vulnerability

Philips lists more than 30 products in DejaBlue Remote Desktop advisory

MedDevice Cyber Staff · Aug 15 · 3 min read · Via Philips security advisory

Philips published a notice on August 15, 2019 on DejaBlue, the Remote Desktop Services remote code execution vulnerabilities CVE-2019-1181 and CVE-2019-1182. The company said its teams were evaluating products that use Microsoft operating systems for potential impact and validating actions.

The list is long. It runs from IntelliSpace PACS 4.4 and 4.4.55x, IntelliSpace Portal Server 7 to 9 and Workstation 7 to 10, Xcelera 4.1, IntelliSpace Cardiovascular 1.x to 3.x and Xper IM 1.5 and 2.x to the Affiniti 30, 50 and 70, Epiq 5 and 7, iE33, CX50/30, ClearVue, Sparq, Envisor and iU22 ultrasound systems, plus MicroDose SI, IntelliSpace Breast, FocalPoint, Juno DRF, XIRIS, UDM, IEM and others.

DejaBlue is wormable remote code execution in Remote Desktop, so any listed system with RDP reachable from the hospital network is exposed without credentials. Turning RDP off where service does not need it is the fastest control available.

Philips directs customers to service for validated patches.

Are you a representative of Philips? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

DejaBlue (CVE-2019-1181, CVE-2019-1182) is remote code execution in Remote Desktop Services on Windows hosts across the listed Philips portfolio. Block or disable RDP on these systems where service does not require it and apply Philips-validated Microsoft patches through service.

Block RDP at the network. Deny TCP 3389 to listed Philips systems except from named service hosts.
Apply validated patches. Install the Philips-approved Microsoft updates for CVE-2019-1181 and CVE-2019-1182.
Enable NLA where allowed. Require Network Level Authentication on Remote Desktop if Philips permits it.
Map Windows hosts to products. Keep a list of which Philips systems run which Windows version.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Named operating system Remote access

Contributing

Hospital network

IntelliSpace PACS

PID-23 PID-41 Named operating system Remote access

Fix the class in your product

The flaw is in the OS inside the controller, or a system past end of service still in the field. As the maker, own the embedded OS and server lifecycle as a safety obligation, design controllers to update in the field, and make every fault degrade to a defined safe state.

Own the OS lifecycle. Patch the OS and server components on a schedule with a tested delivery path.
Design for field update. And for planned replacement, so an unpatchable unit has a path off the network.
Degrade to safe. A fault drives a defined safe state, never an unexpected stop on a life-sustaining device.

Mapped EMB3D mitigations

Questions & Answers

Which Philips products are affected by DejaBlue CVE-2019-1181 and CVE-2019-1182?

Philips listed products including IntelliSpace PACS 4.4, IntelliSpace Portal Server and Workstation, Xcelera 4.1, IntelliSpace Cardiovascular 1.x to 3.x, Xper IM, MicroDose SI, IntelliSpace Breast and the Affiniti, Epiq, iE33, CX50, ClearVue, Sparq, Envisor and iU22 ultrasound systems in its August 15, 2019 DejaBlue notice.

Should Remote Desktop be disabled on Philips systems because of DejaBlue?

Where Philips service does not need it, disabling or blocking Remote Desktop on systems listed in the DejaBlue (CVE-2019-1181, CVE-2019-1182) notice removes the attack path until Philips-validated patches are installed.

← Back to Vulnerabilities