Sign-up

ID

VAR-201109-0127


CVE

CVE-2011-3386


TITLE

Medtronic Paradigm Service disruption in wireless insulin pumps (DoS) Vulnerabilities

Trust: 0.8

sources: JVNDB: JVNDB-2011-004885

DESCRIPTION

Unspecified vulnerability in Medtronic Paradigm wireless insulin pump 512, 522, 712, and 722 allows remote attackers to modify the delivery of an insulin bolus dose and cause a denial of service (adverse human health effects) via unspecified vectors involving wireless communications and knowledge of the device's serial number, as demonstrated by Jerome Radcliffe at the Black Hat USA conference in August 2011. NOTE: the vendor has disputed the severity of this issue, saying "we believe the risk of deliberate, malicious, or unauthorized manipulation of medical devices is extremely low... we strongly believe it would be extremely difficult for a third-party to wirelessly tamper with your insulin pump... you would be able to detect tones on the insulin pump that weren't intentionally programmed and could intervene accordingly.". " Would also be possible. "Service disruption by a third party ( Harmful effects on human health ) There is a possibility of being put into a state. Successful exploits will cause the device to crash, denying service to legitimate users. Medtronic Paradigm wireless insulin pump: 512 522 712 722. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 [slackware-security] libpng (SSA:2012-206-01) New libpng packages are available for Slackware 8.1, 9.0, 9.1, 10.0, 10.1, 10.2, 11.0, 12.0, 12.1, 12.2, 13.0, 13.1, 13.37, and -current to fix security issues. Here are the details from the Slackware 13.37 ChangeLog: +--------------------------+ patches/packages/libpng-1.4.12-i486-1_slack13.37.txz: Upgraded. Fixed incorrect type (int copy should be png_size_t copy) in png_inflate() (fixes CVE-2011-3045). Revised png_set_text_2() to avoid potential memory corruption (fixes CVE-2011-3048). Changed "a+w" to "u+w" in Makefile.in to fix CVE-2012-3386. For more information, see: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3045 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3048 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3386 (* Security fix *) +--------------------------+ Where to find the new packages: +-----------------------------+ Thanks to the friendly folks at the OSU Open Source Lab (http://osuosl.org) for donating FTP and rsync hosting to the Slackware project! :-) Also see the "Get Slack" section on http://slackware.com for additional mirror sites near you. Updated package for Slackware 8.1: ftp://ftp.slackware.com/pub/slackware/slackware-8.1/patches/packages/libpng-1.2.50-i386-1_slack8.1.tgz Updated package for Slackware 9.0: ftp://ftp.slackware.com/pub/slackware/slackware-9.0/patches/packages/libpng-1.2.50-i386-1_slack9.0.tgz Updated package for Slackware 9.1: ftp://ftp.slackware.com/pub/slackware/slackware-9.1/patches/packages/libpng-1.2.50-i486-1_slack9.1.tgz Updated package for Slackware 10.0: ftp://ftp.slackware.com/pub/slackware/slackware-10.0/patches/packages/libpng-1.2.50-i486-1_slack10.0.tgz Updated package for Slackware 10.1: ftp://ftp.slackware.com/pub/slackware/slackware-10.1/patches/packages/libpng-1.2.50-i486-1_slack10.1.tgz Updated package for Slackware 10.2: ftp://ftp.slackware.com/pub/slackware/slackware-10.2/patches/packages/libpng-1.2.50-i486-1_slack10.2.tgz Updated package for Slackware 11.0: ftp://ftp.slackware.com/pub/slackware/slackware-11.0/patches/packages/libpng-1.2.50-i486-1_slack11.0.tgz Updated package for Slackware 12.0: ftp://ftp.slackware.com/pub/slackware/slackware-12.0/patches/packages/libpng-1.2.50-i486-1_slack12.0.tgz Updated package for Slackware 12.1: ftp://ftp.slackware.com/pub/slackware/slackware-12.1/patches/packages/libpng-1.2.50-i486-1_slack12.1.tgz Updated package for Slackware 12.2: ftp://ftp.slackware.com/pub/slackware/slackware-12.2/patches/packages/libpng-1.2.50-i486-1_slack12.2.tgz Updated package for Slackware 13.0: ftp://ftp.slackware.com/pub/slackware/slackware-13.0/patches/packages/libpng-1.2.50-i486-1_slack13.0.txz Updated package for Slackware x86_64 13.0: ftp://ftp.slackware.com/pub/slackware/slackware64-13.0/patches/packages/libpng-1.2.50-x86_64-1_slack13.0.txz Updated package for Slackware 13.1: ftp://ftp.slackware.com/pub/slackware/slackware-13.1/patches/packages/libpng-1.4.12-i486-1_slack13.1.txz Updated package for Slackware x86_64 13.1: ftp://ftp.slackware.com/pub/slackware/slackware64-13.1/patches/packages/libpng-1.4.12-x86_64-1_slack13.1.txz Updated package for Slackware 13.37: ftp://ftp.slackware.com/pub/slackware/slackware-13.37/patches/packages/libpng-1.4.12-i486-1_slack13.37.txz Updated package for Slackware x86_64 13.37: ftp://ftp.slackware.com/pub/slackware/slackware64-13.37/patches/packages/libpng-1.4.12-x86_64-1_slack13.37.txz Updated package for Slackware -current: ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/l/libpng-1.4.12-i486-1.txz Updated package for Slackware x86_64 -current: ftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/l/libpng-1.4.12-x86_64-1.txz MD5 signatures: +-------------+ Slackware 8.1 package: 284b6e6cbd863a3dcfedeb3f7ada3d13 libpng-1.2.50-i386-1_slack8.1.tgz Slackware 9.0 package: 27933d103db0ec5d2e32469e5073d408 libpng-1.2.50-i386-1_slack9.0.tgz Slackware 9.1 package: d7b029366f0f70c218b49101df56cafb libpng-1.2.50-i486-1_slack9.1.tgz Slackware 10.0 package: 3de3405777a72d3a7d72991c4489853e libpng-1.2.50-i486-1_slack10.0.tgz Slackware 10.1 package: e6d10a03b279b2138cab9383e638b621 libpng-1.2.50-i486-1_slack10.1.tgz Slackware 10.2 package: 524e3febb22566c2b3131ca1eee7a385 libpng-1.2.50-i486-1_slack10.2.tgz Slackware 11.0 package: 189f441d29495f927143a7c47ec77afb libpng-1.2.50-i486-1_slack11.0.tgz Slackware 12.0 package: 1e21c28ed8dea4db2d4f8cfc00b858d9 libpng-1.2.50-i486-1_slack12.0.tgz Slackware 12.1 package: 608b1c9f6426159a60722cd23ece3980 libpng-1.2.50-i486-1_slack12.1.tgz Slackware 12.2 package: b1e9950108aa9d2800d639002e6b77a6 libpng-1.2.50-i486-1_slack12.2.tgz Slackware 13.0 package: ae6b82cf5487bdc46422650ba374ff41 libpng-1.2.50-i486-1_slack13.0.txz Slackware x86_64 13.0 package: 409da0ddfd159dd970cccf1c9dee251b libpng-1.2.50-x86_64-1_slack13.0.txz Slackware 13.1 package: 3462a6eb530d084afcd20837b23d0ac7 libpng-1.4.12-i486-1_slack13.1.txz Slackware x86_64 13.1 package: c3058ef9d075ef9083ee7d7a977e6582 libpng-1.4.12-x86_64-1_slack13.1.txz Slackware 13.37 package: e9191494e871534e11ec5020f8e72593 libpng-1.4.12-i486-1_slack13.37.txz Slackware x86_64 13.37 package: 0fea01d53de95669592e9a037c3dc4b9 libpng-1.4.12-x86_64-1_slack13.37.txz Slackware -current package: 29b9148f5beb384e944e34184d24ce59 l/libpng-1.4.12-i486-1.txz Slackware x86_64 -current package: 1b546573b17ac7df03773856cc081692 l/libpng-1.4.12-x86_64-1.txz Installation instructions: +------------------------+ Upgrade the package as root: # upgradepkg libpng-1.4.12-i486-1_slack13.37.txz +-----+ Slackware Linux Security Team http://slackware.com/gpg-key security@slackware.com +------------------------------------------------------------------------+ | To leave the slackware-security mailing list: | +------------------------------------------------------------------------+ | Send an email to majordomo@slackware.com with this text in the body of | | the email message: | | | | unsubscribe slackware-security | | | | You will get a confirmation message back containing instructions to | | complete the process. Please do not reply to this email address. | +------------------------------------------------------------------------+ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) iEYEARECAAYFAlAPVhYACgkQakRjwEAQIjPiGQCfULwZEqcoTlCayAoSYnntgenl fqEAn2hCQqztZMMfLufIVoqDRky/os6w =m4TX -----END PGP SIGNATURE-----

Trust: 2.07

sources: NVD: CVE-2011-3386 // JVNDB: JVNDB-2011-004885 // BID: 49493 // VULHUB: VHN-51331 // PACKETSTORM: 115017

AFFECTED PRODUCTS

vendor:medtronicmodel:paradigm wireless insulin pumpscope:eqversion:512

Trust: 2.4

vendor:medtronicmodel:paradigm wireless insulin pumpscope:eqversion:522

Trust: 2.4

vendor:medtronicmodel:paradigm wireless insulin pumpscope:eqversion:712

Trust: 2.4

vendor:medtronicmodel:paradigm wireless insulin pumpscope:eqversion:722

Trust: 1.6

vendor:medtronicmodel:paradigm wireless insulin pumpscope:eqversion:and 722

Trust: 0.8

vendor:medtronicmodel:paradigmscope:eqversion:7220

Trust: 0.3

vendor:medtronicmodel:paradigmscope:eqversion:712

Trust: 0.3

vendor:medtronicmodel:paradigmscope:eqversion:522

Trust: 0.3

vendor:medtronicmodel:paradigmscope:eqversion:512

Trust: 0.3

sources: BID: 49493 // JVNDB: JVNDB-2011-004885 // CNNVD: CNNVD-201109-009 // NVD: CVE-2011-3386

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2011-3386
value: MEDIUM

Trust: 1.0

NVD: CVE-2011-3386
value: MEDIUM

Trust: 0.8

CNNVD: CNNVD-201109-009
value: MEDIUM

Trust: 0.6

VULHUB: VHN-51331
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2011-3386
severity: MEDIUM
baseScore: 4.0
vectorString: AV:N/AC:H/AU:N/C:N/I:P/A:P
accessVector: NETWORK
accessComplexity: HIGH
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 4.9
impactScore: 4.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-51331
severity: MEDIUM
baseScore: 4.0
vectorString: AV:N/AC:H/AU:N/C:N/I:P/A:P
accessVector: NETWORK
accessComplexity: HIGH
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 4.9
impactScore: 4.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: VULHUB: VHN-51331 // JVNDB: JVNDB-2011-004885 // CNNVD: CNNVD-201109-009 // NVD: CVE-2011-3386

PROBLEMTYPE DATA

problemtype:NVD-CWE-noinfo

Trust: 1.0

sources: NVD: CVE-2011-3386

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201109-009

TYPE

lack of information

Trust: 0.6

sources: CNNVD: CNNVD-201109-009

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2011-004885

PATCH
title:Top Pageurl:http://www.medtronic.com/about-medtronic/index.htm
Trust: 0.8
sources:
            
            
            JVNDB: JVNDB-2011-004885

EXTERNAL IDS
db:NVDid:CVE-2011-3386
Trust: 2.9
db:JVNDBid:JVNDB-2011-004885
Trust: 0.8
db:CNNVDid:CNNVD-201109-009
Trust: 0.7
db:BIDid:49493
Trust: 0.4
db:VULHUBid:VHN-51331
Trust: 0.1
db:PACKETSTORMid:115017
Trust: 0.1
sources:
            
            
            VULHUB: VHN-51331 // 
            
            
            
            BID: 49493 // 
            
            
            
            JVNDB: JVNDB-2011-004885 // 
            
            
            
            PACKETSTORM: 115017 // 
            
            
            
            CNNVD: CNNVD-201109-009 // 
            
            
            
            NVD: CVE-2011-3386

REFERENCES
url:http://www.scmagazineus.com/black-hat-insulin-pumps-can-be-hacked/article/209106/
Trust: 2.0
url:http://sixuntilme.com/blog2/2011/08/hacked_jay_radcliffe_insulin_p.html
Trust: 1.7
url:http://www.darkreading.com/security/vulnerabilities/231300312/getting-root-on-the-human-body.html
Trust: 1.7
url:http://www.foxnews.com/scitech/2011/08/04/insulin-pumps-vulnerable-to-hacking/?test=faces
Trust: 1.7
url:http://www.hanselman.com/blog/hackerscankilldiabeticswithinsulinpumpsfromahalfmileawayumnofactsvsjournalisticfearmongering.aspx
Trust: 1.7
url:http://www.informationweek.com/news/security/vulnerabilities/231600265
Trust: 1.7
url:http://www.loop-blog.com/blog_full_post?id=a09c000000dbz3jiar
Trust: 1.7
url:https://exchange.xforce.ibmcloud.com/vulnerabilities/69643
Trust: 1.1
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2011-3386
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2011-3386
Trust: 0.8
url:http://www.medtronic.com/about-medtronic/index.htm
Trust: 0.3
url:https://nvd.nist.gov/vuln/detail/cve-2011-3045
Trust: 0.1
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2012-3386
Trust: 0.1
url:http://slackware.com
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2011-3048
Trust: 0.1
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2011-3045
Trust: 0.1
url:http://osuosl.org)
Trust: 0.1
url:http://slackware.com/gpg-key
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2011-3386
Trust: 0.1
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2011-3048
Trust: 0.1
sources:
            
            
            VULHUB: VHN-51331 // 
            
            
            
            BID: 49493 // 
            
            
            
            JVNDB: JVNDB-2011-004885 // 
            
            
            
            PACKETSTORM: 115017 // 
            
            
            
            CNNVD: CNNVD-201109-009 // 
            
            
            
            NVD: CVE-2011-3386

CREDITS
Jerome Radcliffe at the Black Hat USA
Trust: 0.3
sources:
            
            
            BID: 49493

SOURCES
db:VULHUBid:VHN-51331
db:BIDid:49493
db:JVNDBid:JVNDB-2011-004885
db:PACKETSTORMid:115017
db:CNNVDid:CNNVD-201109-009
db:NVDid:CVE-2011-3386

LAST UPDATE DATE
2025-04-11T22:08:50.486000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-51331date:2017-08-29T00:00:00
db:BIDid:49493date:2011-09-07T00:00:00
db:JVNDBid:JVNDB-2011-004885date:2012-03-27T00:00:00
db:CNNVDid:CNNVD-201109-009date:2011-09-05T00:00:00
db:NVDid:CVE-2011-3386date:2025-04-11T00:51:21.963

SOURCES RELEASE DATE
db:VULHUBid:VHN-51331date:2011-09-02T00:00:00
db:BIDid:49493date:2011-09-07T00:00:00
db:JVNDBid:JVNDB-2011-004885date:2012-03-27T00:00:00
db:PACKETSTORMid:115017date:2012-07-25T18:22:22
db:CNNVDid:CNNVD-201109-009date:2011-09-05T00:00:00
db:NVDid:CVE-2011-3386date:2011-09-02T23:55:05.427