CVE-2015-8979: Buffer Overflow
At several places in the code a wrong length of ACSE data structures received over the network can cause overflows or underflows when processing those data structures. Related checks have been added at various places in order to prevent such (possible) attacks. The bug will affect all DCMTK-based server applications that accept incoming DICOM network connections.
According to the reports only <= 3.6.0 versions are affected.
References:
http://seclists.org/oss-sec/2016/q4/700 http://www.zeroscience.mk/en/vulnerabilities/ZSL-2016-5384.php
Upstream patch:
https://github.com/commontk/DCMTK/commit/1b6bb76
Other sources
Stack-based buffer overflow in the parsePresentationContext function in storescp in DICOM dcmtk-3.6.0 and earlier allows remote attackers to cause a denial of service (segmentation fault) via a long string sent to TCP port 4242.
— MITRE
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2015-8979?
CVE-2015-8979 is classified as a high severity vulnerability due to its potential to cause overflows or underflows in DCMTK-based services.
How do I fix CVE-2015-8979?
To mitigate CVE-2015-8979, update your DCMTK package to versions 3.6.5-1, 3.6.7-9~deb12u1, or 3.6.8-6 as these versions contain related checks to prevent the vulnerability.
What systems are affected by CVE-2015-8979?
CVE-2015-8979 affects systems running vulnerable versions of the DCMTK package, particularly those on Debian 8.0 and previous versions up to 3.6.0.
What types of attacks can exploit CVE-2015-8979?
CVE-2015-8979 may allow remote attackers to execute arbitrary code or cause service disruptions through crafted ACSE data structures.
Are there any mitigations for CVE-2015-8979 besides updates?
While updating is the primary mitigation for CVE-2015-8979, implementing strict network access controls may also help reduce exposure.