PT-2024-6443 · Unknown+1 · Invesalius+1

Published 2024-08-23 · Updated 2024-12-28 · CVE-2024-42845

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions InVesalius versions 3.1.99991 through 3.1.99998

Description The issue is related to an eval Injection vulnerability in the invesalius/reader/dicom.py component, which allows attackers to execute arbitrary code via loading a crafted DICOM file. This vulnerability is associated with insufficient input validation, enabling a remote attacker to execute arbitrary code by loading a specially crafted DICOM file. The vulnerability is linked to a function in the software that processes the DICOM standard.

Recommendations For InVesalius versions 3.1.99991 through 3.1.99998, consider disabling the dicom.py component in the invesalius/reader directory until a patch is available to prevent the execution of arbitrary code via crafted DICOM files. Restrict access to the DICOM file import functionality to minimize the risk of exploitation. Avoid using the vulnerable dicom.py component for loading DICOM files until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

BDU:2024-07528

CVE-2024-42845

Affected Products

Debian

Invesalius

References · 24

• 🔥 https://github.com/partywavesec/invesalius3_vulnerabilities/tree/main/CVE-2024-42845 · Exploit
• 🔥 https://github.com/partywavesec/invesalius3_vulnerabilities · Exploit
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-42845 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-42845 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-42845 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-42845 · Security Note
• https://bdu.fstec.ru/vul/2024-07528 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2024-42845 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-42845 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-42845 · Vendor Advisory
• https://github.com/invesalius/invesalius3 · Note
• https://github.com/invesalius/invesalius3/releases · Note
• https://twitter.com/defcon201nj/status/1868427028418171281 · Twitter Post
• https://t.me/defcon_news/126989 · Telegram Post
• https://t.me/rnetsec/21070 · Telegram Post