← Advisories

Horos 2.1.0 DICOM Medical Image Viewer Remote Memory Overflow Vulnerability

High
Advisory ID
ZSL-2016-5386
Release Date
16 December 2016
Vendor
Affected Version
2.1.0
CVE
N/A
Tested On
macOS 12.10.2 (Sierra), macOS 12.10.1 (Sierra)
Summary

Horos™ is an open-source, free medical image viewer. The goal of the Horos Project is to develop a fully functional, 64-bit medical image viewer for OS X. Horos is based upon OsiriX and other open source medical imaging libraries.

Description

The vulnerability is caused due to the usage of vulnerable collection of libraries that are part of DCMTK Toolkit, specifically the parser for the DICOM Upper Layer Protocol or DUL. Stack/Heap Buffer overflow/underflow can be triggered when sending and processing wrong length of ACSE data structure received over the network by the DICOM Store-SCP service. An attacker can overflow the stack and the heap of the process when sending large array of bytes to the presentation context item length segment of the DICOM standard, potentially resulting in remote code execution and/or denial of service scenario.

Proof of Concept
Disclosure Timeline
15.12.2016Vendor informed.
Credits
Vulnerability discovered by Gjoko Krstic
References
Changelog
16.12.2016Initial release
20.12.2016Added reference [1], [2], [3] and [4]
24.12.2016Added reference [5]