CVE-2023-32135
📋 TL;DR
A use-after-free vulnerability in Sante DICOM Viewer Pro allows remote attackers to disclose sensitive information when users open malicious DCM files. This affects healthcare organizations and medical professionals using this DICOM viewer software. The vulnerability can potentially lead to arbitrary code execution when combined with other exploits.
💻 Affected Systems
- Sante DICOM Viewer Pro
📦 What is this software?
Dicom Editor by Santesoft
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise via arbitrary code execution leading to data theft, ransomware deployment, or lateral movement within healthcare networks.
Likely Case
Information disclosure of sensitive medical data and system memory contents, potentially enabling further attacks.
If Mitigated
Limited impact with proper network segmentation, application whitelisting, and user training preventing malicious file execution.
🎯 Exploit Status
Requires user interaction (opening malicious file). ZDI advisory suggests this could be chained with other vulnerabilities for code execution.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not specified in references, check vendor advisory
Vendor Advisory: Not provided in references
Restart Required: Yes
Instructions:
1. Check Sante DICOM Viewer Pro vendor website for security updates
2. Download and install latest patched version
3. Restart application and system as required
🔧 Temporary Workarounds
Disable DCM file association
windowsPrevent automatic opening of DCM files with vulnerable viewer
Control Panel > Default Programs > Associate a file type or protocol with a program > Change .dcm association to different application
Application control policy
windowsRestrict execution of Sante DICOM Viewer Pro to trusted locations only
🧯 If You Can't Patch
- Implement strict email filtering to block DCM attachments
- Train users to never open DCM files from untrusted sources
🔍 How to Verify
Check if Vulnerable:
Check Sante DICOM Viewer Pro version against vendor's patched version listCheck Version:
Open Sante DICOM Viewer Pro > Help > About to view version informationVerify Fix Applied:
Verify installation of latest version from vendor and test with known safe DCM files📡 Detection & Monitoring
Log Indicators:
- Application crashes when opening DCM files
- Unusual memory access patterns in application logs
Network Indicators:
- Downloads of DCM files from untrusted sources
- Outbound connections after DCM file processing
SIEM Query:
Process: 'SanteDICOMViewer.exe' AND (EventID: 1000 OR EventID: 1001) AND FileExtension: '.dcm'