Full Report
Cisco Talos’ Vulnerability Research team recently disclosed three vulnerabilities in Observium, three vulnerabilities in Offis, and four vulnerabilities in Whatsup Gold. These vulnerabilities exist in Observium, a network observation and monitoring system; Offis DCMTK, a collection of libraries and applications implementing DICOM (Digital Imaging and Communications
Analysis Summary
# Vulnerability: Multiple Vulnerabilities in Observium, Offis DCMTK, and WhatsUp Gold
## CVE Details
- CVE ID:
- **Observium (XSS/Injection):** CVE-2024-47140, CVE-2024-47002, CVE-2024-45061
- **Offis DCMTK (Code Execution/OOB Write):** CVE-2024-28130, CVE-2024-52333, CVE-2024-47796
- **WhatsUp Gold (Info Disclosure/DoS):** CVE-2024-5017, CVE-2024-12105, CVE-2024-5010, CVE-2024-5011
- CVSS Score: *Not explicitly provided in the text, severity inferred from technical details.*
- CWE: *Not explicitly provided for all, but inferred types include XSS, HTML Injection, Incorrect Type Conversion, Improper Array Index Validation, Information Disclosure, and Denial of Service.*
## Affected Systems
- **Products:** Observium, Offis DCMTK, WhatsUp Gold
- **Versions:** *Specific vulnerable versions are not detailed in this summary.*
- **Configurations:**
- Observium/WhatsUp Gold: Authentication status (authenticated/unauthenticated) affects trigger mechanism for some flaws.
- Offis DCMTK: Affected when processing specially crafted DICOM files.
## Vulnerability Description
The report details multiple vulnerabilities across three distinct products:
1. **Observium:** Three issues were found: two Cross-Site Scripting (XSS) vulnerabilities leading to arbitrary JavaScript execution, and one HTML code injection vulnerability. These require an authenticated user to click a malicious link.
2. **Offis DCMTK:** Three issues in the DICOM library support:
* One incorrect type conversion vulnerability leading to arbitrary code execution.
* Two improper array index validation vulnerabilities leading to out-of-bounds write capabilities.
These are triggered by processing specially crafted, malicious DICOM files.
3. **WhatsUp Gold:** Four issues were reported:
* Two information disclosure vulnerabilities triggered by an authenticated HTTP request.
* One disclosure of sensitive information and one Denial of Service (DoS) vulnerability, both triggered by an unauthenticated HTTP request.
## Exploitation
- Status: *Implied that patches are available, suggesting vendors addressed the issues. No explicit mention of active exploitation.* **Patched by respective vendors.**
- Complexity:
- Observium: Implies low complexity (authenticated user clicking a link).
- Offis DCMTK: Complexity likely medium/high depending on RCE exploit difficulty via crafted file processing.
- WhatsUp Gold: Some flaws are triggered unauthenticated via HTTP request, suggesting lower complexity for those specific issues.
- Attack Vector: Network (for all products via crafted files or HTTP requests).
## Impact
- Confidentiality: High risk due to information disclosure in WhatsUp Gold and potential session hijacking/data theft via XSS in Observium.
- Integrity: Potential high impact via arbitrary code execution (Offis DCMTK) or HTML injection (Observium).
- Availability: Risk of Denial of Service in WhatsUp Gold.
## Remediation
### Patches
- The article confirms that all mentioned vulnerabilities have been **patched by their respective vendors**. Details on specific patch versions are not provided; users should consult vendor advisories for their specific product versions.
### Workarounds
- *No specific workarounds were detailed in the provided text.*
## Detection
- **Indicators of Compromise (IoCs):** Not detailed.
- **Detection methods and tools:** Snort coverage is available to detect the exploitation of these vulnerabilities. Users are advised to download the latest rule sets from [Snort.org](hxxps://snort.org/).
## References
- Cisco’s third-party vulnerability disclosure policy: [Cisco’s third-party vulnerability disclosure policy](hxxps://sec.cloudapps.cisco.com/security/center/resources/vendor_vulnerability_policy.html)
- Snort Rule Sets: [Snort.org](hxxps://snort.org/)
- Talos Intelligence Vulnerability Reports: [Talos Intelligence’s website](hxxps://talosintelligence.com/vulnerability_reports)