Vulnerability

Vyaire CareFusion Upgrade Utility loads planted DLLs on Windows XP systems

MedDevice Cyber Staff · Feb 6 · 2 min read · Via CISA ICSMA-18-037-01

CISA published advisory ICSMA-18-037-01 on February 6, 2018, covering the Vyaire Medical CareFusion Upgrade Utility used with Windows XP systems, version 2.0.2.2 and earlier. Independent researcher Mark Cross (@xerubus) reported the flaw.

CVE-2018-5457 is an uncontrolled search path element (CWE-427) with a CVSS v3 base score of 6.7. A local user installs a crafted DLL on the target machine, the application loads it, and the attacker's code runs at the same privilege level as the utility.

DLL search-order hijacking is an old Windows weakness. An application asks for a library by name, Windows walks a list of directories, and the first match wins. Anyone who can drop a file in a directory early in that list gets code running inside a trusted process. The vector (local access, high complexity, low privileges, user interaction required) holds the score in the medium band, while confidentiality, integrity and availability impacts are all rated high.

Vyaire no longer supports version 2.0.2.2. It released the Vyaire Upgrade Utility 2.0.3.0 and a Product Security Bulletin. The new utility will not install on Windows XP, so taking the fix means updating the underlying system to Windows 7 or later.

The Windows 7 requirement is where the real cost sits for sites still running the utility on XP. A maintenance tool on an unsupported operating system turns every patch into a platform migration.

Are you a representative of Vyaire Medical? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Replace the CareFusion Upgrade Utility 2.0.2.2 with the Vyaire Upgrade Utility 2.0.3.0. The new version does not install on Windows XP, so plan the host upgrade to Windows 7 or later first. Until then, limit local accounts on the host to the people who run updates.

Inventory XP hosts. Find every Windows XP machine running the CareFusion Upgrade Utility 2.0.2.2 or earlier.
Move the host to Windows 7 or later. Vyaire Upgrade Utility 2.0.3.0 will not install on Windows XP.
Install Vyaire Upgrade Utility 2.0.3.0. Download it from Vyaire's spirometry software and firmware downloads page and retire the old utility.
Lock down writable directories. Make sure standard users cannot write to the application folder or other directories the utility searches for DLLs.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Named operating system

CareFusion Upgrade Utility

PID-23 Named operating system

Fix the class in your product

A standard user on the workstation becomes SYSTEM, or the client hands over stored credentials. As the maker, load libraries only from fixed trusted paths, hold short-lived tokens instead of recoverable credentials, and remove user-writable directories from any privileged search path.

Pin library load paths. Restrict the search path and load by full absolute path, never from a working directory.
Hold tokens, not passwords. Keep a short-lived token in the OS vault; store nothing reusable at rest.
Set installer ACLs. No privileged binary loads from a location a standard user can write.

Mapped EMB3D mitigations

Questions & Answers

What versions of the Vyaire CareFusion Upgrade Utility are affected by CVE-2018-5457?

CVE-2018-5457, an uncontrolled search path element flaw with a CVSS v3 score of 6.7, affects the Vyaire Medical CareFusion Upgrade Utility version 2.0.2.2 and earlier used with Windows XP systems. CISA disclosed it in advisory ICSMA-18-037-01 on February 6, 2018.

How do I fix the DLL hijacking flaw in the CareFusion Upgrade Utility?

Upgrade to the Vyaire Upgrade Utility 2.0.3.0, which Vyaire released to replace the unsupported CareFusion Upgrade Utility 2.0.2.2 (CVE-2018-5457, CISA advisory ICSMA-18-037-01, February 6, 2018). The new version will not install on Windows XP, so the host must first move to Windows 7 or later.

← Back to Vulnerabilities