Philips Patient Information Center iX Message Parser length length parameter

Summaryinfo

A vulnerability categorized as problematic has been discovered in Philips Patient Information Center iX, PerformanceBridge Focal Point and IntelliVue Patient Monitor. This impacts an unknown function of the component Message Parser. The manipulation of the argument length as part of Length Field results in length parameter. This vulnerability was named CVE-2020-16224. The attack needs to be approached within the local network. There is no available exploit.

Detailsinfo

A vulnerability, which was classified as problematic, was found in Philips Patient Information Center iX, PerformanceBridge Focal Point and IntelliVue Patient Monitor (Medical Device Software) (affected version unknown). Affected is an unknown functionality of the component Message Parser. The manipulation of the argument length as part of a Length Field leads to a length parameter vulnerability. CWE is classifying the issue as CWE-130. The product parses a formatted message or structure, but it does not handle or incorrectly handles a length field that is inconsistent with the actual length of the associated data. This is going to have an impact on availability. CVE summarizes:

In Patient Information Center iX (PICiX) Versions C.02, C.03, the software parses a formatted message or structure but does not handle or incorrectly handles a length field that is inconsistent with the actual length of the associated data, causing the application on the surveillance station to restart.

The weakness was presented 09/11/2020 (Website). The advisory is shared for download at us-cert.cisa.gov. This vulnerability is traded as CVE-2020-16224 since 07/31/2020. The exploitability is told to be easy. The attack can only be done within the local network. The exploitation doesn't require any form of authentication. There are known technical details, but no exploit is available.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

See VDB-161130, VDB-161131, VDB-161132 and VDB-161133 for similar entries. Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Medical Device Software

Vendor

• Philips

Name

• IntelliVue Patient Monitor
• Patient Information Center iX
• PerformanceBridge Focal Point

License

• commercial

Website

• Vendor: https://www.philips.ch/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion