I am currently investigating the PEDICOM vulnerability CVE-2019-11687 where I am trying to reassemble the P-DATA DICOM fragments from a PCAP. Since the vulnerability takes advantage of writing bytes onto the header, I want to investigate this. When sniffing the network and trying to capture and reassemble the file, when sent over the network using the DICOM protocol does it lose its header and the only information is sent are the different data elements?
When a file is being sent over the network using the DICOM protocol, the file header is lost. This is because the only fragments or parts of the file that is sent are the P-DATA-TF packet data unit which contains patient information as well as the image pixels.
The only way to keep the file header when sent over the network is by using a transfer protocol such as SMB or TFTP.