Full Report
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.7 ATTENTION: Exploitable remotely/low attack complexity Vendor: MicroDicom Equipment: DICOM Viewer Vulnerabilities: Improper Authorization in Handler for Custom URL Scheme, Stack-based Buffer Overflow 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker to both retrieve and plant medical image files on a victim's system and cause a stack-based buffer overflow, which could result in sensitive information disclosure and arbitrary code execution. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS The following versions of MicroDicom DICOM Viewer, a medical image viewer, are affected: DICOM Viewer: Versions prior to 2024.2 3.2 Vulnerability Overview 3.2.1 IMPROPER AUTHORIZATION IN HANDLER FOR CUSTOM URL SCHEME CWE-939 An attacker could retrieve sensitive files (medical images) as well as plant new medical images or overwrite existing medical images on a victim's system. User interaction is required to exploit this vulnerability. CVE-2024-33606 has been assigned to this vulnerability. A CVSS v3.1 base score of 8.8 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). A CVSS v4 score has also been calculated for CVE-2024-33606. A base score of 8.6 has been calculated; the CVSS vector string is (CVSS4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N). 3.2.2 STACK-BASED BUFFER OVERFLOW CWE-121 The affected product is vulnerable to a stack-based buffer overflow, which may allow an attacker to execute arbitrary code on affected installations of DICOM Viewer. User interaction is required to exploit this vulnerability. CVE-2024-28877 has been assigned to this vulnerability. A CVSS v3.1 base score of 8.8 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). A CVSS v4 score has also been calculated for CVE-2024-28877. A base score of 8.7 has been calculated; the CVSS vector string is (CVSS4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N). 3.3 BACKGROUND CRITICAL INFRASTRUCTURE SECTORS: Healthcare and Public Health COUNTRIES/AREAS DEPLOYED: Worldwide COMPANY HEADQUARTERS LOCATION: Bulgaria 3.4 RESEARCHER Michael Heinzl reported these vulnerabilities to CISA. 4. MITIGATIONS MicroDicom recommends users upgrade to DICOM Viewer version 2024.2. CISA recommends users take defensive measures to minimize the risk of exploitation of this these vulnerabilities, such as: Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet. Locate control system networks and remote devices behind firewalls and isolating them from business networks. When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures. CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies. CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies. Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents. CISA also recommends users take the following measures to protect themselves from social engineering attacks: Do not click web links or open attachments in unsolicited email messages. Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams. Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks. No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time. 5. UPDATE HISTORY June 11, 2024: Initial Publication
Analysis Summary
# Vulnerability: MicroDicom DICOM Viewer Improper Authorization and Buffer Overflow
## CVE Details
- CVE ID: CVE-2024-33606, CVE-2024-28877
- CVSS Score: 8.8 (CVSS v3.1 for both) / 8.6 (CVSS v4 for CVE-2024-33606) / 8.7 (CVSS v4 for CVE-2024-28877) (High)
- CWE: (Not explicitly listed, but implied: Improper Authorization, Buffer Overflow)
## Affected Systems
- Products: MicroDicom DICOM Viewer (Medical Image Viewer)
- Versions: Versions prior to 2024.2
- Configurations: User interaction is required for exploitation.
## Vulnerability Description
Two primary vulnerabilities exist in MicroDicom DICOM Viewer:
1. **Improper Authorization (CVE-2024-33606):** Exploitation allows an attacker to read sensitive files (medical images) and plant or overwrite existing medical images on the victim's system via manipulation of a custom URL scheme handler.
2. **Stack-based Buffer Overflow (CVE-2024-28877):** This flaw can be leveraged to achieve arbitrary code execution on affected installations.
Both vulnerabilities require user interaction to be exploited. Successful exploitation could lead to sensitive information disclosure and arbitrary code execution.
## Exploitation
- Status: PoC available (Implied by context regarding remote/low complexity and high impact, though not explicitly stated as public PoC, the description strongly suggests high exploitability factors)
- Complexity: Low (AC:L noted in CVSS strings)
- Attack Vector: Network (AV:N)
- User Interaction: Required (UI:R/UI:A/UI:P noted in CVSS strings)
## Impact
- Confidentiality: High (Arbitrary file read, sensitive information disclosure)
- Integrity: High (Planting or overwriting medical images)
- Availability: High (Potential impact via arbitrary code execution leading to system instability)
## Remediation
### Patches
- Upgrade to MicroDicom DICOM Viewer **version 2024.2** or later.
### Workarounds
Defensive measures recommended by CISA include:
1. Minimize network exposure of all relevant systems, ensuring they are not accessible from the internet.
2. Locate control system networks behind firewalls and isolate them from business networks.
3. When remote access is necessary, use secure methods like Virtual Private Networks (VPNs) and ensure VPN software is fully updated.
## Detection
- **Indicators of Compromise (IOCs):** Unspecified in the summary. Look for anomalous access patterns related to medical image files (reading/writing/deleting) not initiated by legitimate users or processes interacting with custom URI schemes associated with the DICOM viewer.
- **Detection Methods and Tools:** General network monitoring for unusual outbound traffic originating from the affected system or application-specific logs related to custom URL handling.
## References
- Vendor Advisory: MicroDicom downloads page ([hXXps://www.microdicom.com/downloads.html](hXXps://www.microdicom.com/downloads.html))
- CISA Guidance: [hXXps://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01](hXXps://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01)
- Other CISA Guidance Links (General ICS Security):
- [hXXps://www.cisa.gov/topics/industrial-control-systems](hXXps://www.cisa.gov/topics/industrial-control-systems)
- [hXXps://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf](hXXps://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf)
- [hXXps://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf](hXXps://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf)
- [hXXps://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B](hXXps://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B)
- Email/Social Engineering Guidance:
- [hXXps://www.cisa.gov/uscert/sites/default/files/publications/emailscams0905.pdf](hXXps://www.cisa.gov/uscert/sites/default/files/publications/emailscams0905.pdf)
- [hXXps://www.cisa.gov/uscert/ncas/tips/ST04-014](hXXps://www.cisa.gov/uscert/ncas/tips/ST04-014)