PT-2019-12480 · Nema · Nema Dicom Standard

Publicado 2019-05-02 · Atualizado 2019-11-20 · CVE-2019-11687

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions NEMA DICOM Standard versions 1995 through 2019b

Description An issue was discovered in the DICOM Part 10 File Format that allows the preamble of a DICOM file to contain the header for an executable file, such as Portable Executable (PE) malware. This can be exploited by executing a maliciously crafted file encoded in the DICOM Part 10 File Format. The vulnerability is particularly concerning in healthcare facilities, where anti-malware configurations often ignore medical imagery, and processing suspicious DICOM files could violate regulatory frameworks.

Recommendations For NEMA DICOM Standard versions 1995 through 2019b, consider implementing additional security measures to detect and prevent the execution of maliciously crafted DICOM files, such as enhancing anti-malware configurations to inspect medical imagery. As a temporary workaround, restrict the execution of files with the .dcm file extension that contain executable code.

Exploit

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2019-11687

Produtos afetados

Nema Dicom Standard

Referências · 8

• 🔥 https://github.com/d00rt/pedicom · Exploit
• 🔥 https://github.com/kosmokato/bad-dicom · Exploit
• 🔥 https://labs.cylera.com/2019.04.16/pe-dicom-medical-malware · Exploit
• https://github.com/d00rt/pedicom/blob/master/doc/Attacking_Digital_Imaging_and_Communication_in_Medicine_%28DICOM%29_file_format_standard_-_Markel_Picado_Ortiz_%28d00rt%29.pdf · Nota
• https://osv.dev/vulnerability/CVE-2019-11687 · Aviso do Fabricante
• http://securityfocus.com/bid/108730 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-11687 · Nota de Segurança
• https://praetorian.com/blog/elfdicom-poc-malware-polyglot-exploiting-linux-based-medical-devices · Nota