CVE-2020-36855
📋 TL;DR
This CVE describes a stack-based buffer overflow vulnerability in DCMTK's dcmqrscp component. Attackers with local access can exploit the parseQuota function by manipulating StorageQuota arguments, potentially leading to arbitrary code execution. Systems running DCMTK versions up to 3.6.5 are affected.
💻 Affected Systems
- DCMTK (DICOM Toolkit)
📦 What is this software?
Dcmtk by Offis
⚠️ Risk & Real-World Impact
Worst Case
Local privilege escalation leading to full system compromise, data theft, or persistent backdoor installation
Likely Case
Local user gains elevated privileges or crashes the dcmqrscp service causing denial of service
If Mitigated
Service disruption or crash without privilege escalation if exploit fails or is detected
🎯 Exploit Status
Exploit requires local access and knowledge of vulnerable configuration. Public disclosure exists but weaponization status unclear.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.6.6
Vendor Advisory: https://support.dcmtk.org/
Restart Required: Yes
Instructions:
1. Download DCMTK 3.6.6 from official sources. 2. Stop dcmqrscp service. 3. Install/upgrade to version 3.6.6. 4. Restart dcmqrscp service.
🔧 Temporary Workarounds
Disable StorageQuota functionality
allRemove or restrict StorageQuota configuration in dcmqrscp settings
Edit dcmqrscp configuration to remove StorageQuota parameter
Restrict local access
allLimit local user access to systems running dcmqrscp
Implement strict user access controls and privilege separation
🧯 If You Can't Patch
- Implement strict local access controls and user privilege limitations
- Monitor dcmqrscp process for abnormal behavior and crashes
🔍 How to Verify
Check if Vulnerable:
Check DCMTK version and verify if dcmqrscp is running with StorageQuota enabledCheck Version:
dcmtk-config --versionVerify Fix Applied:
Verify DCMTK version is 3.6.6 or later and test StorageQuota functionality📡 Detection & Monitoring
Log Indicators:
- dcmqrscp service crashes
- Abnormal process termination
- Stack overflow error messages
Network Indicators:
- Local connection attempts to dcmqrscp from unusual accounts
SIEM Query:
Process: dcmqrscp AND (EventID: 1000 OR ExceptionCode: c0000409)