Merative Merge DICOM Toolkit C++ up to 5.17.0 on Windows DICOM Association MC_Open_Association format string

Summaryinfo

A vulnerability classified as critical was found in Merative Merge DICOM Toolkit C++ up to 5.17.0 on Windows. The impacted element is the function MC_Open_Association of the component DICOM Association Handler. The manipulation results in format string. This vulnerability is reported as CVE-2024-23914. The attack can be launched remotely. No exploit exists.

Detailsinfo

A vulnerability classified as critical has been found in Merative Merge DICOM Toolkit C++ up to 5.17.0 on Windows. Affected is the function MC_Open_Association of the component DICOM Association Handler. The manipulation with an unknown input leads to a format string vulnerability. CWE is classifying the issue as CWE-134. The product uses a function that accepts a format string as an argument, but the format string originates from an external source. This is going to have an impact on availability. CVE summarizes:

Use of Externally-Controlled Format String vulnerability in Merge DICOM Toolkit C/C++ on Windows. When MC_Open_Association() function is used to open DICOM Association and gets DICOM Application Context Name with illegal characters, it might result in an unhandled exception.

The weakness was disclosed by Gabriele Quagliarella. The advisory is available at nozominetworks.com. This vulnerability is traded as CVE-2024-23914 since 01/23/2024. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Successful exploitation requires user interaction by the victim. Technical details are known, but there is no available exploit. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment (estimation calculated on 05/03/2024).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• Merative

Name

• Merge DICOM Toolkit C++

Version

• 5.0
• 5.1
• 5.2
• 5.3
• 5.4
• 5.5
• 5.6
• 5.7
• 5.8
• 5.9
• 5.10
• 5.11
• 5.12
• 5.13
• 5.14
• 5.15
• 5.16
• 5.17.0

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion