PT-2019-12480 · Nema · Nema Dicom Standard

Published 2019-05-02 · Updated 2019-11-20 · CVE-2019-11687

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions NEMA DICOM Standard versions 1995 through 2019b

Description An issue was discovered in the DICOM Part 10 File Format that allows the preamble of a DICOM file to contain the header for an executable file, such as Portable Executable (PE) malware. This can be exploited by executing a maliciously crafted file encoded in the DICOM Part 10 File Format. The vulnerability is particularly concerning in healthcare facilities, where anti-malware configurations often ignore medical imagery, and processing suspicious DICOM files could violate regulatory frameworks.

Recommendations For NEMA DICOM Standard versions 1995 through 2019b, consider implementing additional security measures to detect and prevent the execution of maliciously crafted DICOM files, such as enhancing anti-malware configurations to inspect medical imagery. As a temporary workaround, restrict the execution of files with the .dcm file extension that contain executable code.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2019-11687

Affected Products

Nema Dicom Standard

References · 8

• 🔥 https://github.com/d00rt/pedicom · Exploit
• 🔥 https://github.com/kosmokato/bad-dicom · Exploit
• 🔥 https://labs.cylera.com/2019.04.16/pe-dicom-medical-malware · Exploit
• https://osv.dev/vulnerability/CVE-2019-11687 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-11687 · Security Note
• https://github.com/d00rt/pedicom/blob/master/doc/Attacking_Digital_Imaging_and_Communication_in_Medicine_%28DICOM%29_file_format_standard_-_Markel_Picado_Ortiz_%28d00rt%29.pdf · Note
• http://securityfocus.com/bid/108730 · Note
• https://praetorian.com/blog/elfdicom-poc-malware-polyglot-exploiting-linux-based-medical-devices · Note