Vulnerability

Philips lists PACS, PIC iX and IntelliBridge products as exposed to the SIGRED Windows DNS flaw

MedDevice Cyber Staff · Jul 15 · 2 min read · Via Philips security advisory

Philips published an advisory on July 15, 2020 on CVE-2020-1350, known as SIGRED, a remote code execution vulnerability in Windows DNS Server. Microsoft reported that the flaw exists when Windows Domain Name System servers fail to properly handle requests.

Philips lists the Clinical Collaboration Platform (formerly Vue PACS), IntelliSpace PACS 4.4 and 4.4.55x, the PIC iX Physiological Server at B.0x and C.0x only when DNS is enabled, IntelliBridge Enterprise versions B.06 to B.12, and UDM 2.1 and 1.1.

The PIC iX condition is the useful detail. Exposure depends on whether the server runs the DNS role, so the fastest triage is checking which installs have it on.

Are you a representative of Philips? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Check each listed Philips system for the Windows DNS Server role and apply the Microsoft fix for CVE-2020-1350 only as Philips authorizes. On PIC iX, confirm whether DNS is enabled. Contact the Philips service representative for patch availability on your configuration.

Find servers with the DNS role. Check the listed Philips systems, especially PIC iX Physiological Servers, for an enabled Windows DNS Server role.
Get Philips approval for the patch. Ask Philips service which CVE-2020-1350 update is validated for your configuration.
Disable unneeded DNS. Where the DNS role is not required for the clinical workflow, have it turned off through authorized service.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure.

Required

Named operating system

Contributing

Off-the-shelf software

Fix the class in your product

The flaw is in the OS inside the controller, or a system past end of service still in the field. As the maker, own the embedded OS and server lifecycle as a safety obligation, design controllers to update in the field, and make every fault degrade to a defined safe state.

Own the OS lifecycle. Patch the OS and server components on a schedule with a tested delivery path.
Design for field update. And for planned replacement, so an unpatchable unit has a path off the network.
Degrade to safe. A fault drives a defined safe state, never an unexpected stop on a life-sustaining device.

Mapped EMB3D mitigations

Questions & Answers

Which Philips products are affected by CVE-2020-1350 SIGRED?

Philips' July 15, 2020 advisory lists Clinical Collaboration Platform (formerly Vue PACS), IntelliSpace PACS 4.4 and 4.4.55x, PIC iX B.0x and C.0x Physiological Server only when DNS is enabled, IntelliBridge Enterprise B.06 to B.12, and UDM 2.1 and 1.1 as affected by CVE-2020-1350.

Is Philips PIC iX affected by the Windows DNS Server vulnerability CVE-2020-1350?

Philips says the PIC iX Physiological Server at B.0x and C.0x is affected by CVE-2020-1350 only when DNS is enabled, per its July 15, 2020 advisory.

← Back to Vulnerabilities