Hospira ICSA-15-161-01 Advisory: Multiple Vulnerabilities in Infusion Systems (CVE-2015-3952-3958)

Key Information Summary Alert Code ICSA-15-161-01 Overview Independent researcher Billy Rios discovered vulnerabilities in Hospira’s Plum A+ infusion system that are similar to those identified in the LifeCare PCA infusion system, as outlined in advisory ICSA-15-125-01B. Hospira identified vulnerabilities in the Symbiq infusion system, while Kyle Kamke of Ramparts, LLC discovered an uncontrolled resource consumption vulnerability in the Hospira Symbiq infusion system. Affected Products Plum A+ Infusion System, versions 13.4 and earlier Plum A3 Infusion System, versions 13.6 and earlier Symbiq Infusion System, versions 3.13 and earlier Impact Successful exploitation of these vulnerabilities could, in the worst case, allow an attacker to affect core device functions. The impact on individual organizations depends on many unique factors. ICS-CERT recommends that organizations assess the impact of these vulnerabilities based on their operational environment, architecture, and product implementation. Vulnerability Characterization Stack-based Buffer Overflow - CVE: CVE-2015-3955NVD - Base Score: 7.6 Improper Authorization - CVE: CVE-2015-3954NVD - Base Score: 10.0 Insufficient Verification of Data Authenticity - CVE: CVE-2015-3956NVD - Base Score: 7.6 Use of Hard-coded Password - CVE: CVE-2015-3953NVD - Base Score: 10.0 Cleartext Storage of Sensitive Information - CVE: CVE-2015-3952NVD - Base Score: 6.4 Key Management Errors - CVE: CVE-2015-3957NVD - Base Score: 4.6 Uncontrolled Resource Consumption - CVE: CVE-2015-3958NVD - Base Score: 7.8 Exploitability Only one of these vulnerabilities can be exploited remotely. Existence of Exploit Publicly available exploit code for these vulnerabilities is known to exist. Difficulty Low-skilled attackers can exploit all but two of these vulnerabilities; the remaining vulnerabilities require high skill to exploit. Mitigation Hospira is communicating with customers to instruct them to disable ports 20/FTP and 23/TELNET on affected devices. Asset owners are advised to implement the following defensive measures: Disable unused ports, including ports 20/FTP and 23/TELNET Change default passwords Monitor and log all network traffic attempting to access affected products Adopt good design practices, including network segmentation Maintain multiple layers of physical and logical security Isolate all medical devices from the internet and untrusted systems Generate MD5 checksums to detect any unauthorized changes

Goal Reached Thanks to every supporter — we hit 100%!

Hospira ICSA-15-161-01 Advisory: Multiple Vulnerabilities in Infusion Systems (CVE-2015-3952-3958)