Grassroots DICOM up to 2.6.1 JPEG-LS Image gdcmJPEGLSCodec.cxx DecodeExtent memory corruption

Summaryinfo

A vulnerability has been found in Grassroots DICOM up to 2.6.1 and classified as problematic. Impacted is the function JPEGLSCodec::DecodeExtent of the file MediaStorageAndFileFormat/gdcmJPEGLSCodec.cxx of the component JPEG-LS Image Handler. The manipulation leads to memory corruption. This vulnerability is referenced as CVE-2015-8397. Remote exploitation of the attack is possible. No exploit is available. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in Grassroots DICOM up to 2.6.1 and classified as critical. This issue affects the function JPEGLSCodec::DecodeExtent of the file MediaStorageAndFileFormat/gdcmJPEGLSCodec.cxx of the component JPEG-LS Image Handler. The manipulation with an unknown input leads to a memory corruption vulnerability. Using CWE to declare the problem leads to CWE-119. The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

The JPEGLSCodec::DecodeExtent function in MediaStorageAndFileFormat/gdcmJPEGLSCodec.cxx in Grassroots DICOM (aka GDCM) before 2.6.2 allows remote attackers to obtain sensitive information from process memory or cause a denial of service (application crash) via an embedded JPEG-LS image with dimensions larger than the selected region in a (1) two-dimensional or (2) three-dimensional DICOM image file, which triggers an out-of-bounds read.

The weakness was published 01/12/2016 (Website). It is possible to read the advisory at securityfocus.com. The identification of this vulnerability is CVE-2015-8397 since 12/02/2015. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details of the vulnerability are known, but there is no available exploit.

The vulnerability scanner Nessus provides a plugin with the ID 88504 (FreeBSD : gdcm -- multiple vulnerabilities (e00d8b94-c88a-11e5-b5fe-002590263bf5)), which helps to determine the existence of the flaw in a target environment. It is assigned to the family FreeBSD Local Security Checks and running in the context l.

Upgrading to version 2.6.2 eliminates this vulnerability. A possible mitigation has been published 3 weeks after the disclosure of the vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (88504). Similar entry is available at VDB-80194. Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• Grassroots

Name

• DICOM

Version

• 2.6.0
• 2.6.1

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion