1. EXECUTIVE SUMMARY
- CVSS v3 7.8
- ATTENTION: Low attack complexity
- Vendor: Santesoft
- Equipment: Sante FFT Imaging
- Vulnerability: Out-of-Bounds Write
2. RISK EVALUATION
Successful exploitation of this vulnerability could allow a local attacker to execute arbitrary code once a user opens a malicious DCM file on affected FFT Imaging installations.
3. TECHNICAL DETAILS
3.1 AFFECTED PRODUCTS
The following Santesoft products are affected:
- Sante FFT Imaging: Versions 1.4.1 and prior
3.2 Vulnerability Overview
3.2.1 OUT-OF-BOUNDS WRITE CWE-787
On Santesoft Sante FFT Imaging versions 1.4.1 and prior once a user opens a malicious DCM file on affected FFT Imaging installations, a local attacker could perform an out-of-bounds write, which could allow for arbitrary code execution.
CVE-2024-1696 has been assigned to this vulnerability. A CVSS v3.1 base score of 7.8 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
3.3 BACKGROUND
- CRITICAL INFRASTRUCTURE SECTORS: Healthcare and Public Health
- COUNTRIES/AREAS DEPLOYED: Worldwide
- COMPANY HEADQUARTERS LOCATION: Cyprus
3.4 RESEARCHER
Michael Heinzl reported this vulnerability to CISA.
4. MITIGATIONS
Santesoft released an updated version of their product and recommends users update Sante FFT Imaging to v1.4.2 or later.
CISA recommends users take the following measures to protect themselves
[…]
Content was cut in order to protect the source.Please visit the source for the rest of the article.
Read the original article: