PT-2019-12102 · Bd · Bd Alaris Gateway Workstation+4

Publicado 2019-06-13 · Atualizado 2019-10-09 · CVE-2019-10959

Positive Technologies (AI Summary)

CVSS v3.1

10

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions BD Alaris Gateway Workstation versions 1.1.3 Build 10 through 1.3.1 Build 13 BD Alaris Gateway Workstation versions 1.3.0 Build 14 Alaris GS version 2.3.6 and below Alaris GH version 2.3.6 and below Alaris CC version 2.3.6 and below Alaris TIVA version 2.3.6 and below

Description The issue allows the upload of malicious files during a firmware update due to a lack of restrictions.

Recommendations For BD Alaris Gateway Workstation versions 1.1.3 Build 10 through 1.3.1 Build 13, update to version 1.3.2 or 1.6.1. For BD Alaris Gateway Workstation version 1.3.0 Build 14, update to version 1.3.2 or 1.6.1. For Alaris GS version 2.3.6 and below, update to a version above 2.3.6. For Alaris GH version 2.3.6 and below, update to a version above 2.3.6. For Alaris CC version 2.3.6 and below, update to a version above 2.3.6. For Alaris TIVA version 2.3.6 and below, update to a version above 2.3.6.

Correção

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

CVE-2019-10959

Produtos afetados

Alaris Cc

Alaris Gh

Alaris Gs

Alaris Tiva

Bd Alaris Gateway Workstation

Referências · 5

• http://securityfocus.com/bid/108765 · Nota
• https://bd.com/en-us/support/product-security-and-privacy/product-security-bulletins/alaris-gateway-workstation-unauthorized-firmware · Aviso do Fabricante
• https://ics-cert.us-cert.gov/advisories/ICSMA-19-164-01 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-10959 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-10959 · Aviso do Fabricante