Updated: 12 January 2022
Products Covered: Spacelabs Patient Monitoring and Diagnostic Cardiology Products

Security Advisory

“Log4Shell” Vulnerability Assessment and Potential Product Impact Statement

1. Vulnerability Overview

Spacelabs Healthcare has been made aware of a recently published security vulnerability known as “Log4Shell” (CVE-2021-44228) that was discovered in a Java-based tool utility called Log4j used in many software applications.

The Apache Log4j utility is a commonly used component for logging requests. On December 9, 2021, a vulnerability was reported that could allow a system running Apache Log4j version 2.14.1 or below to be compromised and allow an attacker to execute arbitrary code.

On December 10, 2021, NIST published a critical Common Vulnerabilities and Exposure alert, CVE-2021-44228. More specifically, Java Naming Directory Interface (JNDI) features used in configuration, log messages, and parameters do not protect against attacker-controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from remote servers when message lookup substitution is enabled.

2. Risk Assessment Summary

The Log4j utility performs network lookups using the Java Naming and Directory Interface (JNDI) via an integration with Lightweight Directory Access Protocol (LDAP). The vulnerability takes advantage of the way Log4j interprets a log message, and by design the tool will look up the string as a URL via JNDI and search whatever text is passed. If malicious text is passed using the ${ } syntax, execution on the passed text can occur with elevated privileges.

Spacelabs Healthcare Patient Monitoring and Connectivity (PMC) and Diagnostic (DC) products do not use the Apache Log4j utility.

Spacelabs Healthcare’s SafeNSound 4.3.1 cloud application was discovered to be impacted and was remediated December 13, 2021. Customers who are on SafeNSound 4.3.1 do not require further follow-up. Customers using other versions of SafeNSound are not impacted.

3. Recommendations

Spacelabs recommends the following as general cybersecurity actions  to an enterprise environment.

• Implement defense-in-depth within the enterprise environment consisting of tools such as Intrusion Detection/Prevention Systems (IDS/IPS), firewalls, and network access control (NAC).
• Configure Intrusion Prevention System (IPS) and update the IPS rulesets to detect traffic by this vulnerability.
• Reach out to your IPS vendor directly to ensure that the software in use by your IPS/IDS system is not affected by this same vulnerability.

IPS can show attempts of testing this vulnerability, but the IPS is not able to stop the attack from reaching your applications.

4. Examination of Spacelabs products

 4.1 Assessment of Spacelabs Products

In response to the publication of these vulnerabilities, Spacelabs has conducted an assessment to identify devices potentially at risk to this set of vulnerabilities. Please note information is subject to change as the situation evolves.

Patient Monitoring and Connectivity (PMC) Products

Diagnostic Cardiology (DC) Products

Safe-N-Sound (SNS)

5. Additional Resources

Terms of Use

The information presented above is subject to change without notice. In no event will Spacelabs or any of its suppliers be liable for direct, indirect, special, incidental or consequential damages of any nature or kind arising from the use of this document, even if Spacelabs or its suppliers have been advised of the possibility of such damages.

Related Resources:

• Apache Logging Services Log4j advisory
• Statement from CISA Director Easterly on “Log4j” Vulnerability 
• CISA Known Exploited Vulnerabilities Catalog (expanded to include CVE-2021-44228)