CVE-2024-22100 - OpenCVE

MicroDicom DICOM Viewer versions 2023.3 (Build 9342) and prior are affected by a heap-based buffer overflow vulnerability, which could allow an attacker to execute arbitrary code on affected installations of DICOM Viewer. A user must open a malicious DCM file in order to exploit the vulnerability.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

No data.

No data.

No data.

References

Link	Providers
https://www.cisa.gov/news-events/ics-medical-advisories/icsma-24-060-01

History

No history.

MITRE

Status: PUBLISHED

Assigner: icscert

Published: 2024-03-01T00:37:47.300Z

Updated: 2024-08-12T20:20:19.945Z

Reserved: 2024-02-12T16:22:12.768Z

Link: CVE-2024-22100

Vulnrichment

Updated: 2024-08-01T22:35:34.715Z

NVD

Status : Awaiting Analysis

Published: 2024-03-01T01:15:07.330

Modified: 2024-03-01T14:04:26.010

Link: CVE-2024-22100

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-22100", "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "state": "PUBLISHED", "assignerShortName": "icscert", "dateReserved": "2024-02-12T16:22:12.768Z", "datePublished": "2024-03-01T00:37:47.300Z", "dateUpdated": "2024-08-12T20:20:19.945Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "DICOM Viewer", "vendor": "MicroDicom", "versions": [{"lessThanOrEqual": " 2023.3 (Build 9342)", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Michael Heinzl reported these vulnerabilities to CISA."}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "\n\n<span style=\"background-color: rgb(255, 255, 255);\">\n\n<span style=\"background-color: rgb(255, 255, 255);\">\n\n<span style=\"background-color: rgb(255, 255, 255);\">MicroDicom DICOM Viewer versions 2023.3 (Build 9342) and prior are affected by a heap-based buffer overflow vulnerability, which could allow an attacker to execute arbitrary code on affected installations of DICOM Viewer. A user must open a malicious DCM file in order to exploit the vulnerability.</span>\n\n</span>\n\n</span>\n\n"}], "value": "\n\n\n\n\nMicroDicom DICOM Viewer versions 2023.3 (Build 9342) and prior are affected by a heap-based buffer overflow vulnerability, which could allow an attacker to execute arbitrary code on affected installations of DICOM Viewer. A user must open a malicious DCM file in order to exploit the vulnerability.\n\n\n\n\n\n"}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-122", "description": "CWE-122", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert", "dateUpdated": "2024-03-01T00:41:25.917Z"}, "references": [{"url": "https://www.cisa.gov/news-events/ics-medical-advisories/icsma-24-060-01"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "\n\n<p>MicroDicom has provided a fix and recommends users upgrade to <a target=\"_blank\" rel=\"nofollow\" href=\"https://www.microdicom.com/\">2024.1</a>.</p><p>For additional assistance, <a target=\"_blank\" rel=\"nofollow\" href=\"https://www.microdicom.com/contacts.html\">contact MicroDicom</a> directly</p>\n\n<br>"}], "value": "\nMicroDicom has provided a fix and recommends users upgrade to 2024.1 https://www.microdicom.com/ .\n\nFor additional assistance, contact MicroDicom https://www.microdicom.com/contacts.html \u00a0directly\n\n\n\n\n"}], "source": {"discovery": "EXTERNAL"}, "title": "MicroDicom DICOM Heap-based Buffer Overflow", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T22:35:34.715Z"}, "title": "CVE Program Container", "references": [{"url": "https://www.cisa.gov/news-events/ics-medical-advisories/icsma-24-060-01", "tags": ["x_transferred"]}]}, {"affected": [{"vendor": "microdicom", "product": "dicom_viewer", "cpes": ["cpe:2.3:a:microdicom:dicom_viewer:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2023.3_build_9342", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-03-04T20:39:49.457575Z", "id": "CVE-2024-22100", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-12T20:20:19.945Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.cisa.gov/news-events/ics-medical-advisories/icsma-24-060-01", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T22:35:34.715Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-22100", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-03-04T20:39:49.457575Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:microdicom:dicom_viewer:*:*:*:*:*:*:*:*"], "vendor": "microdicom", "product": "dicom_viewer", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "2023.3_build_9342"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-12T20:20:12.261Z"}}], "cna": {"title": "MicroDicom DICOM Heap-based Buffer Overflow", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Michael Heinzl reported these vulnerabilities to CISA."}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "MicroDicom", "product": "DICOM Viewer", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": " 2023.3 (Build 9342)"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "\nMicroDicom has provided a fix and recommends users upgrade to 2024.1 https://www.microdicom.com/ .\n\nFor additional assistance, contact MicroDicom https://www.microdicom.com/contacts.html \u00a0directly\n\n\n\n\n", "supportingMedia": [{"type": "text/html", "value": "\n\n<p>MicroDicom has provided a fix and recommends users upgrade to <a target=\"_blank\" rel=\"nofollow\" href=\"https://www.microdicom.com/\">2024.1</a>.</p><p>For additional assistance, <a target=\"_blank\" rel=\"nofollow\" href=\"https://www.microdicom.com/contacts.html\">contact MicroDicom</a> directly</p>\n\n<br>", "base64": false}]}], "references": [{"url": "https://www.cisa.gov/news-events/ics-medical-advisories/icsma-24-060-01"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "\n\n\n\n\nMicroDicom DICOM Viewer versions 2023.3 (Build 9342) and prior are affected by a heap-based buffer overflow vulnerability, which could allow an attacker to execute arbitrary code on affected installations of DICOM Viewer. A user must open a malicious DCM file in order to exploit the vulnerability.\n\n\n\n\n\n", "supportingMedia": [{"type": "text/html", "value": "\n\n<span style=\"background-color: rgb(255, 255, 255);\">\n\n<span style=\"background-color: rgb(255, 255, 255);\">\n\n<span style=\"background-color: rgb(255, 255, 255);\">MicroDicom DICOM Viewer versions 2023.3 (Build 9342) and prior are affected by a heap-based buffer overflow vulnerability, which could allow an attacker to execute arbitrary code on affected installations of DICOM Viewer. A user must open a malicious DCM file in order to exploit the vulnerability.</span>\n\n</span>\n\n</span>\n\n", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-122", "description": "CWE-122"}]}], "providerMetadata": {"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert", "dateUpdated": "2024-03-01T00:41:25.917Z"}}}, "cveMetadata": {"cveId": "CVE-2024-22100", "state": "PUBLISHED", "dateUpdated": "2024-08-12T20:20:19.945Z", "dateReserved": "2024-02-12T16:22:12.768Z", "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "datePublished": "2024-03-01T00:37:47.300Z", "assignerShortName": "icscert"}, "dataVersion": "5.1"}