Vulnerability

Santesoft Sante DICOM Viewer Pro 14.0.3 out-of-bounds read triggered by a malicious DICOM file

MedDevice Cyber Staff · Feb 27 · 2 min read · Via CISA ICSMA-24-058-01

CISA published advisory ICSMA-24-058-01 on February 27, 2024, for Santesoft Sante DICOM Viewer Pro, versions 14.0.3 and prior. Michael Heinzl reported the vulnerability.

CVE-2024-1453 is an out-of-bounds read (CWE-125) with a CVSS v3.1 base score of 7.8. A user must open a malicious DICOM file, and the attacker can then disclose information or execute arbitrary code. Confidentiality, integrity and availability are all rated high.

DICOM files move constantly between modalities, PACS, referring physicians and patients' own media. A viewer that executes whatever a crafted study tells it to makes every inbound image a possible delivery vehicle, and the user interaction requirement is easy to meet when opening images is the job.

Santesoft released an update and recommends moving to Sante DICOM Viewer Pro 14.0.4 or later. CISA added its standard advice about unsolicited email attachments, which fits a file-borne attack.

Image parsers take hostile input by design, so fuzz them with malformed studies before every release.

Are you a representative of Santesoft? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Update Sante DICOM Viewer Pro to 14.0.4 or later. Until then, open DICOM files only from trusted sources and do not open imaging attachments from unsolicited email.

Update to 14.0.4. Install Sante DICOM Viewer Pro 14.0.4 or later on every workstation.
Control file sources. Open DICOM studies only from known modalities, PACS and trusted senders.
Fuzz the DICOM parser. Run malformed DICOM corpora against the parser before each release and fix every out-of-bounds access.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

DICOM or image parsing

Contributing

File import

Sante DICOM Viewer Pro

DICOM or image parsing File import

Fix the class in your product

A crafted file drives the parser out of bounds. As the maker, validate every length and offset against the real buffer before you copy, decode in a sandboxed least-privilege process, and fuzz the path continuously so the next bug is yours to find.

Bound every copy. Check declared sizes against allocated buffers before memcpy; prefer memory-safe parsers for new work.
Sandbox the decoder. Run it least-privilege and isolated so a crash or exploit is contained, not privileged.
Fuzz as a release gate. Run malformed-input fuzzing on every file-format parser before shipping.

Mapped EMB3D mitigations

Products potentially also affected

Products whose own public documentation shares this advisory's attributes. A shared attribute is a lead, not a finding. The status column shows only what each manufacturer has said.

Product	Manufacturer	Shared with this advisory	Manufacturer status
Monaco RTP System	Elekta	Same property (MITRE EMB3D)PID-3122	No feedback feed from manufacturer
WatchMate Software	Anumana	Same signals	No feedback feed from manufacturer
Vitrea Software Package	Canon Medical	Same signals	No feedback feed from manufacturer
Image Suite	Carestream Health	Same signals	No feedback feed from manufacturer
aPROMISE	Exini Diagnostics	Same signals	No feedback feed from manufacturer
AutoSeg	Fujifilm Healthcare	Same signals	No feedback feed from manufacturer
Synapse PACS	Fujifilm Healthcare	Same signals	No feedback feed from manufacturer
BreView	GE HealthCare	Same signals	No feedback feed from manufacturer
EchoPAC Software Only / EchoPAC Plug-in	GE HealthCare	Same signals	No feedback feed from manufacturer
MR Contour DL	GE HealthCare	Same signals	No feedback feed from manufacturer
Contour ProtégéAI+	MIM Software	Same signals	No feedback feed from manufacturer
Image Management V15	Philips	Same signals	No feedback feed from manufacturer
OptimMRI	Rebrain	Same signals	No feedback feed from manufacturer
syngo Application Software	Siemens Healthineers	Same signals	No feedback feed from manufacturer
ART-Plan+	TheraPanacea	Same signals	No feedback feed from manufacturer

2 more products match. Each manufacturer page lists its products and the advisories they share attributes with.

Questions & Answers

What is CVE-2024-1453 in Sante DICOM Viewer Pro?

CVE-2024-1453 is an out-of-bounds read (CWE-125, CVSS v3.1 7.8) in Santesoft Sante DICOM Viewer Pro 14.0.3 and prior. Opening a malicious DICOM file could let an attacker disclose information or execute arbitrary code, per CISA advisory ICSMA-24-058-01 from February 27, 2024.

Which Sante DICOM Viewer Pro version fixes CVE-2024-1453?

Santesoft recommends updating Sante DICOM Viewer Pro to version 14.0.4 or later to fix CVE-2024-1453, per CISA advisory ICSMA-24-058-01.

← Back to Vulnerabilities