Critical Flaws Reported in Philips Vue PACS Medical Imaging Systems
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2018-11218 +1 in the same advisory: …12326 | Memory Corruption was discovered in the cmsgpack library in the Lua subsystem in Redis before 3.2.12, 4.x before 4.0.10, and 5.x before 5.0 RC2 because of stack Memory Corruption was discovered in the cmsgpack library in the Lua subsystem in Redis before 3.2.12, 4.x before 4.0.10, and 5.x before 5.0 RC2 because of stack-based buffer overflows. NVD description · AI analysis pending | 9.8 group max | 59% | PoC ×2 |
| — | |
| CVE-2018-8014 | The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are insecure and e The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are insecure and enable 'supportsCredentials' for all origins. It is expected that users of the CORS filter will have configured it appropriately for their environment rather than using it in the default configuration. Therefore, it is expected that most users will not be impacted by this issue. NVD description · AI analysis pending | 9.8 | 22% |
| — | ||
| CVE-2020-1938 | Ghostcat (CVE-2020-1938): Unauthenticated File Read/JSP RCE via AJP in Apache Tomcat CVE-2020-1938 ('Ghostcat') is an improper privilege management flaw in Apache Tomcat's Apache JServ Protocol (AJP) connector, which shipped enabled by default listening on all interfaces (typically port 8009) in Tomcat 9.0.0.M1-9.0.0.30, 8.5.0-8.5.50 and 7.0.0-7.0.99, and which treats AJP connections as far more trusted than equivalent HTTP connections. An attacker who can reach the AJP port without authentication can inject crafted AJP attributes to make Tomcat return arbitrary files from anywhere in the web application or process any file in the web application as JSP. If the application allows file uploads stored within the web application (or the attacker can otherwise control file content), this escalates to unauthenticated remote code execution. Exposure is conditional: only deployments where the AJP port is reachable by untrusted users are at risk, but Tomcat's very large installed base, including vendor bundles from Oracle, NetApp, Debian, openSUSE, Fedora and BlackBerry, means many hundreds of thousands of systems are potentially affected. The flaw is known to be exploited: it was added to CISA's KEV on 2022-03-03, EPSS estimates a 99.3% probability of exploitation within 30 days (100th percentile), and mass scanning of exposed Tomcat AJP ports was publicly reported. Do: Upgrade to Apache Tomcat 9.0.31, 8.5.51, or 7.0.100 or later, noting that the hardened default AJP connector configuration in these releases may require small configuration changes after upgrade. If you cannot upgrade, disable the AJP connector if unused, or bind it to localhost/restrict firewall access so port 8009 is not reachable by untrusted users. Check whether the AJP port is exposed to the internet and whether any web application allows file uploads into the web application directory, since that is what converts file read into remote code execution. | 9.8 | 99% | KEV PoC |
| masshundreds of thousands of internet-exposed Tomcat AJP endpoints (order of magnitude: 100,000+ exposed systems) | |
| CVE-2020-4670 | IBM Planning Analytics Local 2.0 connects to a Redis server. IBM Planning Analytics Local 2.0 connects to a Redis server. The Redis server, an in-memory data structure store, running on the remote host is not protected by password authentication. A remote attacker can exploit this to gain unauthorized access to the server. IBM X-Force ID: 186401. NVD description · AI analysis pending | 9.1 | 2% |
| — | ||
| CVE-2021-27501 | Philips Vue PACS versions 12.2.x.x and prior does not follow certain coding rules for development, which can lead to resultant weaknesses or increase the severi Philips Vue PACS versions 12.2.x.x and prior does not follow certain coding rules for development, which can lead to resultant weaknesses or increase the severity of the associated vulnerabilities. NVD description · AI analysis pending | 9.8 group max | <1% |
| — |
Full article381 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananJul 09, 2021
Multiple security vulnerabilities have been disclosed in Philips Clinical Collaboration Platform Portal (aka Vue PACS), some of which could be exploited by an adversary to take control of an affected system.
"Successful exploitation of these vulnerabilities could allow an unauthorized person or process to eavesdrop, view or modify data, gain system access, perform code execution, install unauthorized software, or affect system data integrity in such a way as to negatively impact the confidentiality, integrity, or availability of the system," the U.S. Cybersecurity and Infrastructure Security Agency (CISA) noted in an advisory.
The 15 flaws impact:
- VUE Picture Archiving and Communication Systems (versions 12.2.x.x and prior),
- Vue MyVue (versions 12.2.x.x and prior),
- Vue Speech (versions 12.2.x.x and prior), and
- Vue Motion (versions 12.2.1.5 and prior)
Four of the issues (CVE-2020-1938, CVE-2018-12326, CVE-2018-11218, CVE-2020-4670, and CVE-2018-8014) have been given a Common Vulnerability Scoring System (CVSS) base score of 9.8, and concern improper validation of input data as well as vulnerabilities introduced by flaws previously patched in Redis.
Another serious flaw (CVE-2021-33020, CVSS score: 8.2) is caused by the Vue platform's use of cryptographic keys beyond their established expiration date, "which diminishes its safety significantly by increasing the timing window for cracking attacks against that key."
Other weaknesses involve the use of a broken or risky cryptographic algorithm (CVE-2021-33018), a cross-site scripting attack when handling user-controllable input (CVE-2015-9251), insecure methods to protect authentication credentials (CVE-2021-33024), improper or incorrect initialization of resources (CVE-2018-8014), and a failure to follow coding standards (CVE-2021-27501) that could increase the severity of the other vulnerabilities.
While Philips has addressed some of the shortcomings as part of its updates shipped in June 2020 and May 2021, the Dutch healthcare company is expected to patch the rest of the security issues in version 15 of Speech, MyVue, and PACS that's currently in development and set for release in Q1 2022.
In the interim, CISA is urging entities to minimize network exposure for all control system devices and ensure that they are not accessible from the Internet, segment control system networks and remote devices behind firewalls, and use virtual private networks (VPNs) for secure remote access.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2021/07/critical-flaws-reported-in-philips-vue.html