PT-2019-12102 · Bd · Bd Alaris Gateway Workstation+4

Published 2019-06-13 · Updated 2019-10-09 · CVE-2019-10959

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions BD Alaris Gateway Workstation versions 1.1.3 Build 10 through 1.3.1 Build 13 BD Alaris Gateway Workstation versions 1.3.0 Build 14 Alaris GS version 2.3.6 and below Alaris GH version 2.3.6 and below Alaris CC version 2.3.6 and below Alaris TIVA version 2.3.6 and below

Description The issue allows the upload of malicious files during a firmware update due to a lack of restrictions.

Recommendations For BD Alaris Gateway Workstation versions 1.1.3 Build 10 through 1.3.1 Build 13, update to version 1.3.2 or 1.6.1. For BD Alaris Gateway Workstation version 1.3.0 Build 14, update to version 1.3.2 or 1.6.1. For Alaris GS version 2.3.6 and below, update to a version above 2.3.6. For Alaris GH version 2.3.6 and below, update to a version above 2.3.6. For Alaris CC version 2.3.6 and below, update to a version above 2.3.6. For Alaris TIVA version 2.3.6 and below, update to a version above 2.3.6.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2019-10959

Affected Products

Alaris Cc

Alaris Gh

Alaris Gs

Alaris Tiva

Bd Alaris Gateway Workstation

References · 5

• https://bd.com/en-us/support/product-security-and-privacy/product-security-bulletins/alaris-gateway-workstation-unauthorized-firmware · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-10959 · Security Note
• https://osv.dev/vulnerability/CVE-2019-10959 · Vendor Advisory
• http://securityfocus.com/bid/108765 · Note
• https://ics-cert.us-cert.gov/advisories/ICSMA-19-164-01 · Note