Horizon Alert
Summary of the vulnerability and why it matters
An information leak vulnerability exists in the Grassroots DICOM software, specifically within its JPEGBITSCodec. A malicious DICOM file could exploit this to expose data, potentially impacting systems that process medical imaging files. The primary concern is to confirm if this specific technology is in use and whether it is exposed to such files.
- Malicious files can cause unintended data exposure.
- Confirm relevance to our medical imaging processing.
- Assess exposure to specially crafted DICOM files.
Attack Path
How an attacker could exploit the issue
An attacker can exploit this vulnerability by providing a specially crafted DICOM file. This malicious file targets the `JPEGBITSCodec::InternalCode` functionality within Grassroots DICOM, leading to an information leak. The vulnerability can be triggered when the `grayscale_convert` function is invoked based on the content of the malicious DICOM file.
- Entry condition: Attacker provides a malicious file.
- Trigger point: JPEGBITSCodec::InternalCode function.
- Resulting risk: Information leak and denial of service.
Live Threat
Current exploitation, exposure, and threat context
A vulnerability in the JPEGBITSCodec::InternalCode functionality of Grassroots DICOM could allow an attacker to leak information by providing a specially crafted DICOM file. This occurs when the `grayscale_convert` function is called based on the content of a malicious DICOM file, potentially exposing sensitive data related to image pixel interpretation.
- DICOM image data and system memory.
- Malicious DICOM file processing.
- Potential information disclosure.
Operational Fix
Recommended remediation, mitigation, and detection steps
The Grassroots DICOM library's `JPEGBITSCodec::InternalCode` function, affected by a critical out-of-bounds read vulnerability, likely falls under the responsibility of application owners or platform teams that integrate this DICOM processing capability. The first step for these teams is to locate all instances of Grassroots DICOM, assess their exposure, determine business criticality, and identify the accountable personnel before planning remediation.
- Application or platform teams own this.
- Verify DICOM file processing exposure.
- Plan targeted remediation or risk reduction.
