CVE-2013-6825 - DCMTK 3.6.1 - root privilege escalation

Hector Marco; Ismael Ripoll

CVE-2013-6825 - DCMTK 3.6.1 - root privilege escalation

Hector Marco
, Ismael Ripoll

Research output: Other contribution

Abstract

A bug in DCMTK for versions prior to 3.6.1 has been found. The bug is caused by not checking the return value of setuid() call. The process must not continue its normal execution when this call fails (return an error) to drop privileges.

Original language	English
Type	CVE-2013-6825
Publisher	http://hmarco.org
Publication status	Published - 25 Mar 2014

Access to Document

http://hmarco.org/bugs/dcmtk-3.6.1-privilege-escalation.html

Cite this

@misc{bb80ab7b211d4ddcb25edc9a28be7564,

title = "CVE-2013-6825 - DCMTK 3.6.1 - root privilege escalation",

abstract = "A bug in DCMTK for versions prior to 3.6.1 has been found. The bug is caused by not checking the return value of setuid() call. The process must not continue its normal execution when this call fails (return an error) to drop privileges.",

author = "Hector Marco and Ismael Ripoll",

year = "2014",

month = mar,

day = "25",

language = "English",

publisher = "http://hmarco.org",

address = "United Kingdom",

type = "Other",

}

TY - GEN

T1 - CVE-2013-6825 - DCMTK 3.6.1 - root privilege escalation

AU - Marco, Hector

AU - Ripoll, Ismael

PY - 2014/3/25

Y1 - 2014/3/25

N2 - A bug in DCMTK for versions prior to 3.6.1 has been found. The bug is caused by not checking the return value of setuid() call. The process must not continue its normal execution when this call fails (return an error) to drop privileges.

AB - A bug in DCMTK for versions prior to 3.6.1 has been found. The bug is caused by not checking the return value of setuid() call. The process must not continue its normal execution when this call fails (return an error) to drop privileges.

M3 - Other contribution

PB - http://hmarco.org

ER -

CVE-2013-6825 - DCMTK 3.6.1 - root privilege escalation

Abstract

Access to Document

Fingerprint

Cite this