PT-2018-18672 · Microsoft+1 · Windows Os+3

Published 2018-05-04 · Updated 2019-10-09 · CVE-2018-8861

Positive Technologies (AI Summary)

CVSS v3.1

8.7

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions Philips Brilliance CT kiosk environment versions prior to the following: Brilliance 64 version 2.6.2 Brilliance iCT version 4.1.6 Brilliance iCT SP version 3.2.4 Brilliance CT Big Bore version 2.3.5

Description The issue allows a limited-access kiosk user or an unauthorized attacker to break out from the kiosk environment containment, gain elevated privileges from the underlying Windows OS, and access unauthorized resources from the operating system.

Recommendations For Brilliance 64 version 2.6.2 and prior, update to a version later than 2.6.2. For Brilliance iCT versions 4.1.6 and prior, update to a version later than 4.1.6. For Brilliance iCT SP versions 3.2.4 and prior, update to a version later than 3.2.4. For Brilliance CT Big Bore version 2.3.5 and prior, update to a version later than 2.3.5.

Fix

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-668

Related Identifiers

CVE-2018-8861

Affected Products

Brilliance 64

Brilliance Ct Big Bore

Brilliance Ict

Windows Os

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2018-8861 · Security Note
• https://usa.philips.com/healthcare/about/customer-support/product-security · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-8861 · Vendor Advisory
• https://ics-cert.us-cert.gov/advisories/ICSMA-18-123-01 · Note
• http://securityfocus.com/bid/104088 · Note