CVE-2015-8979

What it actually does

Stack-based buffer overflow in parsePresentationContext within storescp allows remote unauthenticated input to overwrite the stack and trigger a segmentation fault.

Why it matters to the business

DICOM storage services can be crashed remotely, interrupting medical image transfer workflows and requiring manual restarts until the service is updated.

How an attack unfolds

An attacker connects to TCP port 4242 and sends an oversized presentation context string that exceeds the fixed buffer in parsePresentationContext, causing immediate process termination; public exploits have been available for years.

How to fix it

Upgrade dcmtk to a version newer than 3.6.0 that contains the corrected parsePresentationContext implementation; if no newer package is available, replace storescp with a maintained DICOM implementation or apply vendor backports.

How to confirm the fix worked

Confirm the running storescp binary version is greater than 3.6.0; perform a controlled connection with an oversized presentation context and verify the process no longer crashes.

Typical attack path

1. Scan for hosts listening on TCP 4242
2. Send crafted oversized presentation context PDU
3. Trigger segmentation fault and service crash
4. Repeat to maintain denial of service

How to detect it

Review system and application logs for abrupt storescp terminations around the time of unexpected inbound connections to TCP 4242; correlate with network flow data showing single-packet or short-session connections from untrusted sources.

• storescp segmentation fault
• parsePresentationContext
• TCP 4242 oversized PDU

What your security team should do

• Immediately restrict inbound access to TCP 4242 to trusted imaging systems only
• Inventory all deployments of dcmtk storescp and schedule upgrades
• Monitor for service restarts or crashes on DICOM hosts
• Plan migration to a supported DICOM toolkit if upstream fixes are unavailable