Sign-up

ID

VAR-201803-2092


CVE

CVE-2018-5464


TITLE

Philips Intellispace Portal Cryptographic vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2018-003327

DESCRIPTION

Philips IntelliSpace Portal all versions of 8.0.x, and 7.0.x have an untrusted SSL certificate vulnerability this could allow an attacker to gain unauthorized access to resources and information. Philips Intellispace Portal Contains a cryptographic vulnerability.Information may be obtained. The Philips Intellispace Portal can process clinical images from different modes and enables advanced visualization of the images. ISP systems are deployed in the healthcare and public health sectors. 1. A remote code-execution vulnerability 2. Multiple privilege-escalation vulnerabilities 3. A cryptographic security vulnerability Attackers can exploit these issues to execute arbitrary code within the context of affected device, cause a denial-of-service condition, bypass certain security restrictions, obtain sensitive information or gain unauthorized access to the device and perform unauthorized actions. This may lead to complete compromise of the device. Intellispace Portal versions 8.0.x and 7.0.x are vulnerable. The system provides viewing of echographic images and a single point of access for physicians. An encryption issue vulnerability exists in Philips ISP versions 8.0.x and 7.0.x

Trust: 2.52

sources: NVD: CVE-2018-5464 // JVNDB: JVNDB-2018-003327 // CNVD: CNVD-2018-03809 // BID: 103182 // VULHUB: VHN-135495

AFFECTED PRODUCTS

vendor:philipsmodel:intellispace portalscope:eqversion:8.0

Trust: 1.9

vendor:philipsmodel:intellispace portalscope:eqversion:9.0

Trust: 1.6

vendor:philipsmodel:intellispace portalscope:eqversion:8.0.x

Trust: 1.4

vendor:philipsmodel:intellispace portalscope:eqversion:7.0.x

Trust: 1.4

vendor:philipsmodel:intellispace portalscope:eqversion:7.0

Trust: 0.3

sources: CNVD: CNVD-2018-03809 // BID: 103182 // JVNDB: JVNDB-2018-003327 // CNNVD: CNNVD-201803-778 // NVD: CVE-2018-5464

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2018-5464
value: HIGH

Trust: 1.0

NVD: CVE-2018-5464
value: HIGH

Trust: 0.8

CNVD: CNVD-2018-03809
value: MEDIUM

Trust: 0.6

CNNVD: CNNVD-201803-778
value: HIGH

Trust: 0.6

VULHUB: VHN-135495
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2018-5464
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

CNVD: CNVD-2018-03809
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

VULHUB: VHN-135495
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2018-5464
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 3.9
impactScore: 3.6
version: 3.0

Trust: 1.8

sources: CNVD: CNVD-2018-03809 // VULHUB: VHN-135495 // JVNDB: JVNDB-2018-003327 // CNNVD: CNNVD-201803-778 // NVD: CVE-2018-5464

PROBLEMTYPE DATA

problemtype:CWE-310

Trust: 1.9

problemtype:CWE-295

Trust: 1.1

sources: VULHUB: VHN-135495 // JVNDB: JVNDB-2018-003327 // NVD: CVE-2018-5464

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201803-778

TYPE

trust management problem

Trust: 0.6

sources: CNNVD: CNNVD-201803-778

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2018-003327

PATCH
title:Philips IntelliSpace Portal Vulnerabilities (26-FEB-2018)url:https://www.usa.philips.com/healthcare/about/customer-support/product-security
Trust: 0.8
title:Patch for Philips Intellispace Portal Unauthorized Access Vulnerability (CNVD-2018-03809)url:https://www.cnvd.org.cn/patchInfo/show/119243
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2018-03809 // 
            
            
            
            JVNDB: JVNDB-2018-003327

EXTERNAL IDS
db:NVDid:CVE-2018-5464
Trust: 3.4
db:ICS CERTid:ICSMA-18-058-02
Trust: 3.4
db:BIDid:103182
Trust: 2.0
db:JVNDBid:JVNDB-2018-003327
Trust: 0.8
db:CNNVDid:CNNVD-201803-778
Trust: 0.7
db:CNVDid:CNVD-2018-03809
Trust: 0.6
db:VULHUBid:VHN-135495
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2018-03809 // 
            
            
            
            VULHUB: VHN-135495 // 
            
            
            
            BID: 103182 // 
            
            
            
            JVNDB: JVNDB-2018-003327 // 
            
            
            
            CNNVD: CNNVD-201803-778 // 
            
            
            
            NVD: CVE-2018-5464

REFERENCES
url:https://ics-cert.us-cert.gov/advisories/icsma-18-058-02
Trust: 3.4
url:http://www.securityfocus.com/bid/103182
Trust: 1.7
url:https://www.usa.philips.com/healthcare/about/customer-support/product-security
Trust: 1.7
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-5464
Trust: 0.8
url:https://nvd.nist.gov/vuln/detail/cve-2018-5464
Trust: 0.8
url:http://www.usa.philips.com/
Trust: 0.3
sources:
            
            
            CNVD: CNVD-2018-03809 // 
            
            
            
            VULHUB: VHN-135495 // 
            
            
            
            BID: 103182 // 
            
            
            
            JVNDB: JVNDB-2018-003327 // 
            
            
            
            CNNVD: CNNVD-201803-778 // 
            
            
            
            NVD: CVE-2018-5464

CREDITS
The vendor reported this issue.
Trust: 0.3
sources:
            
            
            BID: 103182

SOURCES
db:CNVDid:CNVD-2018-03809
db:VULHUBid:VHN-135495
db:BIDid:103182
db:JVNDBid:JVNDB-2018-003327
db:CNNVDid:CNNVD-201803-778
db:NVDid:CVE-2018-5464

LAST UPDATE DATE
2024-11-23T21:20:13.056000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2018-03809date:2018-02-28T00:00:00
db:VULHUBid:VHN-135495date:2019-10-09T00:00:00
db:BIDid:103182date:2018-02-27T00:00:00
db:JVNDBid:JVNDB-2018-003327date:2018-05-22T00:00:00
db:CNNVDid:CNNVD-201803-778date:2019-10-17T00:00:00
db:NVDid:CVE-2018-5464date:2024-11-21T04:08:51.047

SOURCES RELEASE DATE
db:CNVDid:CNVD-2018-03809date:2018-02-28T00:00:00
db:VULHUBid:VHN-135495date:2018-03-26T00:00:00
db:BIDid:103182date:2018-02-27T00:00:00
db:JVNDBid:JVNDB-2018-003327date:2018-05-22T00:00:00
db:CNNVDid:CNNVD-201803-778date:2018-03-22T00:00:00
db:NVDid:CVE-2018-5464date:2018-03-26T14:29:00.417