CVE-2015-3459 – Hospira Lifecare PCA Infusion Pump

Re:CVE-2015-3459 – Hospira Lifecare PCA Infusion Pump by mkehrt on Monday May 04, 2015 @07:25PM (#9489906)

For example, I think pacemakers can set the range of acceptable heart rates by radio. So now, you have to have logic checking that it doesn't get set to 0. But what happens if there's a buffer overflow in that checking?

Edit: here's a paper demonstrating similar attacks: http://www.secure-medicine.org/public/publications/icd-study...

[ Parent | on HN ]

Re:CVE-2015-3459 – Hospira Lifecare PCA Infusion Pump by TheLoneWolfling on Monday May 04, 2015 @08:29PM (#9490196)

See, that's an example of something that I do not think should be settable via radio. Maybe inductive or sonic communication.

Alternatively, you have the software check the set range, but the hardware (or a second non-connected processor) also checks it separately to make sure it's sane anyways.

[ Parent | on HN ]