SB2020091113 - Multiple vulnerabilities in Philips Patient Monitoring Devices

Description

This security bulletin contains information about 8 secuirty vulnerabilities.

1) CSV Injection (CVE-ID: CVE-2020-16214)

The vulnerability allows a local user to inject arbitrary data into CSV files.

The vulnerability exists due to improper input validation when generating CSV files. A local administrator can create specially crafted CSV files and trick the victim into exporting the file with malicious content.

2) Cross-site scripting (CVE-ID: CVE-2020-16218)

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote authenticated attacker on the local network can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

3) Improper Authentication (CVE-ID: CVE-2020-16222)

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to an error in when processing authentication requests. A remote attacker on the local network can bypass authentication process and gain unauthorized access to the application.

4) Improper Check for Certificate Revocation (CVE-ID: CVE-2020-16228)

The vulnerability allows a remote user to compromise the target system.

The vulnerability exists due to the affected software does not check or incorrectly checks the revocation status of a certificate. A remote administrator on the local network can compromise certificate.

5) Improper Handling of Length Parameter Inconsistency (CVE-ID: CVE-2020-16224)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to the affected software parses a formatted message or structure but does not handle or incorrectly handles a length field that is inconsistent with the actual length of the associated data. A remote attacker on the local network can cause the application on the surveillance station to restart.  

6) Input validation error (CVE-ID: CVE-2020-16220)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper validation of syntactic correctness of input. A remote attacker on the local network can pass specially crafted input to the application and crash the certificate enrollment service.

7) Input validation error (CVE-ID: CVE-2020-16216)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker on the local network can pass specially crafted input to the application and perform a denial of service (DoS) attack.

8) Exposure of Resource to Wrong Sphere (CVE-ID: CVE-2020-16212)

The vulnerability allows a local attacker to compromise the target system.

The vulnerability exists due to the affected product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource. An attacker with physical access can escape the restricted environment with limited privileges.

Remediation

Cybersecurity Help is not aware of any official remediation provided by the vendor.

References

• https://ics-cert.us-cert.gov/advisories/icsma-20-254-01