CVE-2024-23621

The vulnerability results from incorrect buffer size calculation (CWE-131) and lack of proper boundary verification when copying data to the buffer (CWE-120 — classic buffer overflow). An attacker can send a specially crafted network request to the license server without the need for authentication, causing buffer overflow. This results in the possibility of taking control over the program execution flow and executing arbitrary code in the context of the license server process.

A remote, unauthenticated attacker can gain full control over the system by executing arbitrary code (RCE), which potentially leads to violation of confidentiality, integrity, and availability of the system and data.

Patches available from the vendor should be applied in accordance with the references. Additionally, it is recommended to restrict network access to the license server exclusively to trusted hosts using a firewall and to monitor network traffic directed to this component.

IBM Merge Healthcare eFilm Workstation — specific versions indicated in vendor references and Exodus Intel publication