CVE-2013-6825
Description
(1) movescu.cc and (2) storescp.cc in dcmnet/apps/, (3) dcmnet/libsrc/scp.cc, (4) dcmwlm/libsrc/wlmactmg.cc, (5) dcmprscp.cc and (6) dcmpsrcv.cc in dcmpstat/apps/, (7) dcmpstat/tests/msgserv.cc, and (8) dcmqrdb/apps/dcmqrscp.cc in DCMTK 3.6.1 and earlier does not check the return value of the setuid system call, which allows local users to gain privileges by creating a large number of processes.
Predictions
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
Mitigation details
CVE-2013-6825 NameCVE-2013-6825 Description(1) movescu.cc and (2) storescp.cc in dcmnet/apps/, (3) dcmnet/libsrc/scp.cc, (4) dcmwlm/libsrc/wlmactmg.cc, (5) dcmprscp.cc and (6) dcmpsrcv.cc in dcmpstat/apps/, (7) dcmpstat/tests/msgserv.cc, and (8) dcmqrdb/apps/dcmqrscp.cc in DCMTK 3.6.1 and earlier does not check the return value of the setuid system call, which allows local users to gain…
CVE-2013-6825
| Name | CVE-2013-6825 |
| Description | (1) movescu.cc and (2) storescp.cc in dcmnet/apps/, (3) dcmnet/libsrc/scp.cc, (4) dcmwlm/libsrc/wlmactmg.cc, (5) dcmprscp.cc and (6) dcmpsrcv.cc in dcmpstat/apps/, (7) dcmpstat/tests/msgserv.cc, and (8) dcmqrdb/apps/dcmqrscp.cc in DCMTK 3.6.1 and earlier does not check the return value of the setuid system call, which allows local users to gain privileges by creating a large number of processes. |
| Source | CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
Vulnerable and fixed packages
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|---|---|---|
| dcmtk (PTS) | bullseye | 3.6.5-1 | fixed |
| bullseye (security) | 3.6.5-1+deb11u6 | fixed | |
| bookworm | 3.6.7-9~deb12u3 | fixed | |
| trixie | 3.6.9-5 | fixed | |
| forky | 3.7.0+really3.7.0-2 | fixed | |
| sid | 3.7.0+really3.7.0-3 | fixed |
The information below is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|---|---|---|---|---|---|
| dcmtk | source | (unstable) | 3.6.1~20150629-1 | unimportant |
Notes
http://hmarco.org/bugs/dcmtk-3.6.1-privilege-escalation.html
Not running with elevated privileges in Debian packaging
http://git.dcmtk.org/web?p=dcmtk.git;a=commitdiff;h=beaf5a5c24101daeeafa48c375120b16197c9e95;hp=5349794c4c458c76609b7aeb53d0ca28cf9fe9f0
Apply commands
http://hmarco.org/bugs/dcmtk-3.6.1-privilege-escalation.htmlNot running with elevated privileges in Debian packaginghttp://git.dcmtk.org/web?p=dcmtk.git;a=commitdiff;h=beaf5a5c24101daeeafa48c375120b16197c9e95;hp=5349794c4c458c76609b7aeb53d0ca28cf9fe9f0OS impact
Debian Fixed 5 releases
| Version | Status | Fixed in |
|---|---|---|
| trixie | Fixed | 3.6.1~20150629-1 |
| sid | Fixed | 3.6.1~20150629-1 |
| forky | Fixed | 3.6.1~20150629-1 |
| bullseye | Fixed | 3.6.1~20150629-1 |
| bookworm | Fixed | 3.6.1~20150629-1 |
References
- http://git.dcmtk.org/web?p=dcmtk.git%3Ba=blob%3Bf=CHANGES.361
- http://packetstormsecurity.com/files/126883/DCMTK-Privilege-Escalation.html
- http://seclists.org/fulldisclosure/2014/Jun/11
- http://secunia.com/advisories/58916
- http://www.securityfocus.com/archive/1/532261/100/0/threaded
- http://www.securityfocus.com/bid/67784
- https://security-tracker.debian.org/tracker/CVE-2013-6825
CWEs
CWE-264
Community-verified mitigations for this CVE will appear above when contributors publish them.
Verify integrity in audit chain (admin only). AS-IS.