CVE-2024-34509: 
NixOS vulnerability analysis and mitigation

CVE-2024-34509 affects dcmdata in DCMTK versions before 3.6.9, where a segmentation fault can occur via an invalid DIMSE message. The vulnerability was discovered in early 2024 and publicly disclosed on May 5, 2024. This security issue impacts the DCMTK (DICOM Toolkit) software, which is a collection of libraries and applications implementing large parts of the DICOM standard for medical images (NVD, Ubuntu).

The vulnerability stems from insufficient error handling in the dcmdata component of DCMTK, which can lead to a dereferenced NULL pointer while processing invalid DIMSE (DICOM Message Service Element) messages. The issue has been assigned a CVSS v3.1 Base Score of 5.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, indicating that it can be exploited remotely with low attack complexity and requires no privileges or user interaction (NVD).

The vulnerability can cause a segmentation fault in the affected DCMTK installations, potentially leading to service disruption in medical imaging systems that rely on DCMTK for DICOM communication. This could affect the availability of medical imaging services in healthcare environments (Debian LTS).

The vulnerability can be triggered by sending an invalid DIMSE message to a system running the affected version of DCMTK. A proof of concept exists demonstrating the exploitation by using netcat to send malformed data to a DCMTK server listening on a specific port (DCMTK Issue).

The vulnerability has been fixed in DCMTK version 3.6.9 through a commit that addresses the NULL pointer dereference issue. Various Linux distributions have also released security updates to address this vulnerability. Users are advised to upgrade to the patched version or apply the available security updates from their respective distribution vendors (DCMTK Commit).