CVE-2015-8979: Buffer Overflow
First published: Mon Dec 19 2016(Updated: )
At several places in the code a wrong length of ACSE data structures received over the network can cause overflows or underflows when processing those data structures. Related checks have been added at various places in order to prevent such (possible) attacks. The bug will affect all DCMTK-based server applications that accept incoming DICOM network connections. According to the reports only <= 3.6.0 versions are affected. References: <a href="http://seclists.org/oss-sec/2016/q4/700">http://seclists.org/oss-sec/2016/q4/700</a> <a href="http://www.zeroscience.mk/en/vulnerabilities/ZSL-2016-5384.php">http://www.zeroscience.mk/en/vulnerabilities/ZSL-2016-5384.php</a> Upstream patch: <a href="https://github.com/commontk/DCMTK/commit/1b6bb76">https://github.com/commontk/DCMTK/commit/1b6bb76</a>
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| debian/dcmtk | 3.6.5-1 3.6.7-9~deb12u1 3.6.8-6 | |
| Debian Linux | =8.0 | |
| DCMTK | <=3.6.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://packetstormsecurity.com/files/140191/DCMTK-storescp-DICOM-storage-C-STORE-SCP-Remote-Stack-Buffer-Overflow.html
- http://www.debian.org/security/2016/dsa-3749
- http://www.openwall.com/lists/oss-security/2016/12/18/2
- http://www.securityfocus.com/bid/94951
- http://www.zeroscience.mk/en/vulnerabilities/ZSL-2016-5384.php
- https://bugzilla.redhat.com/show_bug.cgi?id=1405919
- http://seclists.org/oss-sec/2016/q4/700
- https://github.com/commontk/DCMTK/commit/1b6bb76
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8979
- https://nvd.nist.gov/vuln/detail/CVE-2015-8979
- https://launchpad.net/bugs/cve/CVE-2015-8979
- https://security-tracker.debian.org/tracker/CVE-2015-8979
- https://ubuntu.com/security/CVE-2015-8979
- http://zeroscience.mk/en/vulnerabilities/ZSL-2016-5384.php
- https://www.openwall.com/lists/oss-security/2016/12/17/2
Frequently Asked Questions
What is the severity of CVE-2015-8979?
CVE-2015-8979 is classified as a high severity vulnerability due to its potential to cause overflows or underflows in DCMTK-based services.
How do I fix CVE-2015-8979?
To mitigate CVE-2015-8979, update your DCMTK package to versions 3.6.5-1, 3.6.7-9~deb12u1, or 3.6.8-6 as these versions contain related checks to prevent the vulnerability.
What systems are affected by CVE-2015-8979?
CVE-2015-8979 affects systems running vulnerable versions of the DCMTK package, particularly those on Debian 8.0 and previous versions up to 3.6.0.
What types of attacks can exploit CVE-2015-8979?
CVE-2015-8979 may allow remote attackers to execute arbitrary code or cause service disruptions through crafted ACSE data structures.
Are there any mitigations for CVE-2015-8979 besides updates?
While updating is the primary mitigation for CVE-2015-8979, implementing strict network access controls may also help reduce exposure.
- agent/type
- agent/first-publish-date
- agent/remedy
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/last-modified-date
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2015-8979
- collector/usn-cve
- source/Ubuntu
- agent/description
- collector/launchpad-cve
- source/Launchpad
- collector/security-tracker-debian
- source/Debian
- agent/software-canonical-lookup
- agent/references
- agent/author
- agent/event
- agent/trending
- agent/source
- agent/weakness
- collector/nvd-cve
- source/NVD
- agent/software-canonical-lookup-request
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- package-manager/debian
- vendor/debian
- canonical/debian linux
- version/debian linux/8.0
- vendor/dicom
- canonical/dcmtk
- version/dcmtk/3.6.0