Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2021-44009 (GCVE-0-2021-44009)
Vulnerability from cvelistv5 – Published: 2021-12-14 12:06 – Updated: 2024-08-04 04:10
VLAI?
EPSS
Summary
A vulnerability has been identified in JT2Go (All versions < V13.2.0.5), Teamcenter Visualization (All versions < V13.2.0.5). The Tiff_Loader.dll is vulnerable to an out of bounds read past the end of an allocated buffer when parsing TIFF files. An attacker could leverage this vulnerability to leak information in the context of the current process.
Severity ?
No CVSS data available.
CWE
- CWE-125 - Out-of-bounds Read
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Siemens | JT2Go |
Affected:
All versions < V13.2.0.5
|
|||||||
|
|||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T04:10:17.166Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-595101.pdf"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "JT2Go",
"vendor": "Siemens",
"versions": [
{
"status": "affected",
"version": "All versions \u003c V13.2.0.5"
}
]
},
{
"product": "Teamcenter Visualization",
"vendor": "Siemens",
"versions": [
{
"status": "affected",
"version": "All versions \u003c V13.2.0.5"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability has been identified in JT2Go (All versions \u003c V13.2.0.5), Teamcenter Visualization (All versions \u003c V13.2.0.5). The Tiff_Loader.dll is vulnerable to an out of bounds read past the end of an allocated buffer when parsing TIFF files. An attacker could leverage this vulnerability to leak information in the context of the current process."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125: Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-12-14T12:06:46",
"orgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77",
"shortName": "siemens"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-595101.pdf"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "productcert@siemens.com",
"ID": "CVE-2021-44009",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "JT2Go",
"version": {
"version_data": [
{
"version_value": "All versions \u003c V13.2.0.5"
}
]
}
},
{
"product_name": "Teamcenter Visualization",
"version": {
"version_data": [
{
"version_value": "All versions \u003c V13.2.0.5"
}
]
}
}
]
},
"vendor_name": "Siemens"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A vulnerability has been identified in JT2Go (All versions \u003c V13.2.0.5), Teamcenter Visualization (All versions \u003c V13.2.0.5). The Tiff_Loader.dll is vulnerable to an out of bounds read past the end of an allocated buffer when parsing TIFF files. An attacker could leverage this vulnerability to leak information in the context of the current process."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-125: Out-of-bounds Read"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://cert-portal.siemens.com/productcert/pdf/ssa-595101.pdf",
"refsource": "MISC",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-595101.pdf"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77",
"assignerShortName": "siemens",
"cveId": "CVE-2021-44009",
"datePublished": "2021-12-14T12:06:46",
"dateReserved": "2021-11-18T00:00:00",
"dateUpdated": "2024-08-04T04:10:17.166Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"fkie_nvd": {
"configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:siemens:jt2go:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"13.2.0.5\", \"matchCriteriaId\": \"16503D23-333C-4282-B4FE-EF51ED89209A\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:siemens:teamcenter_visualization:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"13.2.0.5\", \"matchCriteriaId\": \"6C1C132F-3514-40F7-B7F9-D4FD8C36029A\"}]}]}]",
"descriptions": "[{\"lang\": \"en\", \"value\": \"A vulnerability has been identified in JT2Go (All versions \u003c V13.2.0.5), Teamcenter Visualization (All versions \u003c V13.2.0.5). The Tiff_Loader.dll is vulnerable to an out of bounds read past the end of an allocated buffer when parsing TIFF files. An attacker could leverage this vulnerability to leak information in the context of the current process.\"}, {\"lang\": \"es\", \"value\": \"Se ha identificado una vulnerabilidad en JT2Go (Todas las versiones anteriores a V13.2.0.5), Teamcenter Visualization (Todas las versiones anteriores a V13.2.0.5). El archivo Tiff_Loader.dll es vulnerable a una lectura fuera de l\\u00edmites m\\u00e1s all\\u00e1 del final de un b\\u00fafer asignado al analizar archivos TIFF. Un atacante podr\\u00eda aprovechar esta vulnerabilidad para filtrar informaci\\u00f3n en el contexto del proceso actual\"}]",
"id": "CVE-2021-44009",
"lastModified": "2024-11-21T06:30:12.190",
"metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N\", \"baseScore\": 5.5, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"REQUIRED\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 3.6}], \"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:N/AC:M/Au:N/C:P/I:N/A:N\", \"baseScore\": 4.3, \"accessVector\": \"NETWORK\", \"accessComplexity\": \"MEDIUM\", \"authentication\": \"NONE\", \"confidentialityImpact\": \"PARTIAL\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"NONE\"}, \"baseSeverity\": \"MEDIUM\", \"exploitabilityScore\": 8.6, \"impactScore\": 2.9, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": true}]}",
"published": "2021-12-14T12:15:10.510",
"references": "[{\"url\": \"https://cert-portal.siemens.com/productcert/pdf/ssa-595101.pdf\", \"source\": \"productcert@siemens.com\", \"tags\": [\"Patch\", \"Vendor Advisory\"]}, {\"url\": \"https://cert-portal.siemens.com/productcert/pdf/ssa-595101.pdf\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\", \"Vendor Advisory\"]}]",
"sourceIdentifier": "productcert@siemens.com",
"vulnStatus": "Modified",
"weaknesses": "[{\"source\": \"productcert@siemens.com\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-125\"}]}]"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2021-44009\",\"sourceIdentifier\":\"productcert@siemens.com\",\"published\":\"2021-12-14T12:15:10.510\",\"lastModified\":\"2024-11-21T06:30:12.190\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A vulnerability has been identified in JT2Go (All versions \u003c V13.2.0.5), Teamcenter Visualization (All versions \u003c V13.2.0.5). The Tiff_Loader.dll is vulnerable to an out of bounds read past the end of an allocated buffer when parsing TIFF files. An attacker could leverage this vulnerability to leak information in the context of the current process.\"},{\"lang\":\"es\",\"value\":\"Se ha identificado una vulnerabilidad en JT2Go (Todas las versiones anteriores a V13.2.0.5), Teamcenter Visualization (Todas las versiones anteriores a V13.2.0.5). El archivo Tiff_Loader.dll es vulnerable a una lectura fuera de l\u00edmites m\u00e1s all\u00e1 del final de un b\u00fafer asignado al analizar archivos TIFF. Un atacante podr\u00eda aprovechar esta vulnerabilidad para filtrar informaci\u00f3n en el contexto del proceso actual\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:M/Au:N/C:P/I:N/A:N\",\"baseScore\":4.3,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":8.6,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":true}]},\"weaknesses\":[{\"source\":\"productcert@siemens.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-125\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:siemens:jt2go:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"13.2.0.5\",\"matchCriteriaId\":\"16503D23-333C-4282-B4FE-EF51ED89209A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:siemens:teamcenter_visualization:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"13.2.0.5\",\"matchCriteriaId\":\"6C1C132F-3514-40F7-B7F9-D4FD8C36029A\"}]}]}],\"references\":[{\"url\":\"https://cert-portal.siemens.com/productcert/pdf/ssa-595101.pdf\",\"source\":\"productcert@siemens.com\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"https://cert-portal.siemens.com/productcert/pdf/ssa-595101.pdf\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Vendor Advisory\"]}]}}"
}
}
CERTFR-2021-AVI-949
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été découvertes dans les produits Siemens. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service et un contournement de la politique de sécurité.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Siemens | N/A | APOGEE MEC (PPC) (BACnet) toutes versions | ||
| Siemens | N/A | SIMATIC eaSie PCS 7 Skill Package (6DL5424-0BX00-0AV8) versions antérieures à 21.00 SP3 | ||
| Siemens | N/A | Siveillance Identity V5 versions antérieures à 1.6.284, ou sans le correctif de sécurité SP5 | ||
| Siemens | N/A | SIMATIC ITC2200 V3 PRO versions antérieures à 3.2.1.0 | ||
| Siemens | N/A | Desigo PXC22.1-E.D toutes versions postérieures à 2.3 | ||
| Siemens | N/A | SINUMERIK Edge versions antérieures à 3.2 | ||
| Siemens | N/A | Desigo PXC36.1-E.D toutes versions postérieures à 2.3 | ||
| Siemens | N/A | Capital VSTAR toutes versions avec l'option Ethernet activée | ||
| Siemens | N/A | JTTK versions antérieures à 11.1.1.0 | ||
| Siemens | N/A | Teamcenter Active Workspace versions 5.2.x antérieures à 5.2.3 | ||
| Siemens | N/A | Desigo PXC00-E.D toutes versions postérieures à 2.3 | ||
| Siemens | N/A | POWER METER SICAM Q100 (7KG9501-0AA31-0AA1) versions antérieures à 2.41 | ||
| Siemens | N/A | Questa Simulation toutes versions | ||
| Siemens | N/A | Desigo PXC00-U toutes versions postérieures à 2.3 | ||
| Siemens | N/A | SIMATIC ITC1900 V3 PRO versions antérieures à 3.2.1.0 | ||
| Siemens | N/A | SIMATIC ITC1900 V3 versions antérieures à 3.2.1.0 | ||
| Siemens | N/A | SIMATIC ITC1500 V3 versions antérieures à 3.2.1.0 | ||
| Siemens | N/A | SIMATIC ITC2200 V3 versions antérieures à 3.2.1.0 | ||
| Siemens | N/A | JT Utilities versions antérieures à 13.1.1.0 | ||
| Siemens | N/A | POWER METER SICAM Q100 (7KG9501-0AA01-0AA1) versions antérieures à 2.41 | ||
| Siemens | N/A | Desigo PXC001-E.D toutes versions postérieures à 2.3 | ||
| Siemens | N/A | Desigo PXC64-U toutes versions postérieures à 2.3 | ||
| Siemens | N/A | Teamcenter Active Workspace versions 5.0.x antérieures à 5.0.10 | ||
| Siemens | N/A | ModelSim Simulation toutes versions | ||
| Siemens | N/A | Teamcenter Active Workspace versions 5.1.x antérieures à 5.1.6 | ||
| Siemens | N/A | Desigo PXC200-E.D toutes versions postérieures à 2.3 | ||
| Siemens | N/A | Desigo PXC12-E.D toutes versions postérieures à 2.3 | ||
| Siemens | N/A | Teamcenter Active Workspace versions 4.3.x antérieures à V4.3.11 | ||
| Siemens | N/A | SIMATIC ITC1500 V3 PRO versions antérieures à 3.2.1.0 | ||
| Siemens | N/A | JT Utilities versions antérieures à 12.8.1.1 | ||
| Siemens | N/A | SiPass integrated versions antérieures à 2.85 | ||
| Siemens | N/A | Teamcenter Visualization versions antérieures à 13.2.0.5 | ||
| Siemens | N/A | Desigo PXC22-E.D toutes versions postérieures à 2.3 | ||
| Siemens | N/A | JT Utilities versions antérieures à 13.0.3.0 | ||
| Siemens | N/A | Simcenter STAR-CCM+ Viewer versions antérieures à 2021.3.1 | ||
| Siemens | N/A | Siveillance Identity V1.6 versions antérieures à 1.6.284.0 | ||
| Siemens | N/A | JTTK versions antérieures à 10.8.1.1 | ||
| Siemens | N/A | POWER METER SICAM Q100 (7KG9501-0AA31-2AA1) versions antérieures à 2.41 | ||
| Siemens | N/A | Desigo PXC100-E.D toutes versions postérieures à 2.3 | ||
| Siemens | N/A | SiPass integrated versions antérieures à 2.76 | ||
| Siemens | N/A | Desigo PXC50-E.D toutes versions postérieures à 2.3 | ||
| Siemens | N/A | JT2Go versions antérieures à 13.2.0.5 | ||
| Siemens | N/A | JTTK versions antérieures à 11.0.3.0 | ||
| Siemens | N/A | Desigo PXC128-U toutes versions postérieures à 2.3 | ||
| Siemens | N/A | SiPass integrated versions antérieures à 2.80 | ||
| Siemens | N/A | APOGEE MBC (PPC) (P2 Ethernet) toutes versions | ||
| Siemens | N/A | APOGEE PXC Modular (BACnet) toutes versions | ||
| Siemens | N/A | APOGEE MBC (PPC) (BACnet) toutes versions | ||
| Siemens | N/A | APOGEE PXC Compact (BACnet) toutes versions | ||
| Siemens | N/A | APOGEE MEC (PPC) (P2 Ethernet) toutes versions | ||
| Siemens | N/A | APOGEE PXC Compact (P2 Ethernet) toutes versions | ||
| Siemens | N/A | APOGEE PXC Modular (P2 Ethernet) toutes versions | ||
| Siemens | N/A | POWER METER SICAM Q100 (7KG9501-0AA01-2AA1) versions antérieures à 2.41 |
References
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "APOGEE MEC (PPC) (BACnet) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC eaSie PCS 7 Skill Package (6DL5424-0BX00-0AV8) versions ant\u00e9rieures \u00e0 21.00 SP3",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Siveillance Identity V5 versions ant\u00e9rieures \u00e0 1.6.284, ou sans le correctif de s\u00e9curit\u00e9 SP5",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC ITC2200 V3 PRO versions ant\u00e9rieures \u00e0 3.2.1.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Desigo PXC22.1-E.D toutes versions post\u00e9rieures \u00e0 2.3",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SINUMERIK Edge versions ant\u00e9rieures \u00e0 3.2",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Desigo PXC36.1-E.D toutes versions post\u00e9rieures \u00e0 2.3",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Capital VSTAR toutes versions avec l\u0027option Ethernet activ\u00e9e",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "JTTK versions ant\u00e9rieures \u00e0 11.1.1.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Teamcenter Active Workspace versions 5.2.x ant\u00e9rieures \u00e0 5.2.3",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Desigo PXC00-E.D toutes versions post\u00e9rieures \u00e0 2.3",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "POWER METER SICAM Q100 (7KG9501-0AA31-0AA1) versions ant\u00e9rieures \u00e0 2.41",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Questa Simulation toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Desigo PXC00-U toutes versions post\u00e9rieures \u00e0 2.3",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC ITC1900 V3 PRO versions ant\u00e9rieures \u00e0 3.2.1.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC ITC1900 V3 versions ant\u00e9rieures \u00e0 3.2.1.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC ITC1500 V3 versions ant\u00e9rieures \u00e0 3.2.1.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC ITC2200 V3 versions ant\u00e9rieures \u00e0 3.2.1.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "JT Utilities versions ant\u00e9rieures \u00e0 13.1.1.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "POWER METER SICAM Q100 (7KG9501-0AA01-0AA1) versions ant\u00e9rieures \u00e0 2.41",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Desigo PXC001-E.D toutes versions post\u00e9rieures \u00e0 2.3",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Desigo PXC64-U toutes versions post\u00e9rieures \u00e0 2.3",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Teamcenter Active Workspace versions 5.0.x ant\u00e9rieures \u00e0 5.0.10",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "ModelSim Simulation toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Teamcenter Active Workspace versions 5.1.x ant\u00e9rieures \u00e0 5.1.6",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Desigo PXC200-E.D toutes versions post\u00e9rieures \u00e0 2.3",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Desigo PXC12-E.D toutes versions post\u00e9rieures \u00e0 2.3",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Teamcenter Active Workspace versions 4.3.x ant\u00e9rieures \u00e0 V4.3.11",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC ITC1500 V3 PRO versions ant\u00e9rieures \u00e0 3.2.1.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "JT Utilities versions ant\u00e9rieures \u00e0 12.8.1.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SiPass integrated versions ant\u00e9rieures \u00e0 2.85",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Teamcenter Visualization versions ant\u00e9rieures \u00e0 13.2.0.5",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Desigo PXC22-E.D toutes versions post\u00e9rieures \u00e0 2.3",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "JT Utilities versions ant\u00e9rieures \u00e0 13.0.3.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Simcenter STAR-CCM+ Viewer versions ant\u00e9rieures \u00e0 2021.3.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Siveillance Identity V1.6 versions ant\u00e9rieures \u00e0 1.6.284.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "JTTK versions ant\u00e9rieures \u00e0 10.8.1.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "POWER METER SICAM Q100 (7KG9501-0AA31-2AA1) versions ant\u00e9rieures \u00e0 2.41",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Desigo PXC100-E.D toutes versions post\u00e9rieures \u00e0 2.3",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SiPass integrated versions ant\u00e9rieures \u00e0 2.76",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Desigo PXC50-E.D toutes versions post\u00e9rieures \u00e0 2.3",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "JT2Go versions ant\u00e9rieures \u00e0 13.2.0.5",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "JTTK versions ant\u00e9rieures \u00e0 11.0.3.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Desigo PXC128-U toutes versions post\u00e9rieures \u00e0 2.3",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SiPass integrated versions ant\u00e9rieures \u00e0 2.80",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "APOGEE MBC (PPC) (P2 Ethernet) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "APOGEE PXC Modular (BACnet) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "APOGEE MBC (PPC) (BACnet) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "APOGEE PXC Compact (BACnet) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "APOGEE MEC (PPC) (P2 Ethernet) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "APOGEE PXC Compact (P2 Ethernet) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "APOGEE PXC Modular (P2 Ethernet) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "POWER METER SICAM Q100 (7KG9501-0AA01-2AA1) versions ant\u00e9rieures \u00e0 2.41",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2021-44443",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-44443"
},
{
"name": "CVE-2021-31881",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-31881"
},
{
"name": "CVE-2021-44444",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-44444"
},
{
"name": "CVE-2021-44009",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-44009"
},
{
"name": "CVE-2021-31888",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-31888"
},
{
"name": "CVE-2021-44447",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-44447"
},
{
"name": "CVE-2018-20749",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-20749"
},
{
"name": "CVE-2021-44013",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-44013"
},
{
"name": "CVE-2021-31885",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-31885"
},
{
"name": "CVE-2021-31887",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-31887"
},
{
"name": "CVE-2019-15690",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-15690"
},
{
"name": "CVE-2021-44012",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-44012"
},
{
"name": "CVE-2020-14396",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-14396"
},
{
"name": "CVE-2021-44001",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-44001"
},
{
"name": "CVE-2020-14404",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-14404"
},
{
"name": "CVE-2021-44430",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-44430"
},
{
"name": "CVE-2021-44440",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-44440"
},
{
"name": "CVE-2021-44432",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-44432"
},
{
"name": "CVE-2021-44445",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-44445"
},
{
"name": "CVE-2021-31884",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-31884"
},
{
"name": "CVE-2021-44434",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-44434"
},
{
"name": "CVE-2021-44449",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-44449"
},
{
"name": "CVE-2019-15681",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-15681"
},
{
"name": "CVE-2021-44435",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-44435"
},
{
"name": "CVE-2021-42023",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42023"
},
{
"name": "CVE-2021-44442",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-44442"
},
{
"name": "CVE-2021-44002",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-44002"
},
{
"name": "CVE-2021-44014",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-44014"
},
{
"name": "CVE-2021-44436",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-44436"
},
{
"name": "CVE-2021-31882",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-31882"
},
{
"name": "CVE-2021-44438",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-44438"
},
{
"name": "CVE-2021-44006",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-44006"
},
{
"name": "CVE-2021-41547",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-41547"
},
{
"name": "CVE-2021-44008",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-44008"
},
{
"name": "CVE-2021-44017",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-44017"
},
{
"name": "CVE-2021-44441",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-44441"
},
{
"name": "CVE-2021-44011",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-44011"
},
{
"name": "CVE-2018-20748",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-20748"
},
{
"name": "CVE-2019-20788",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-20788"
},
{
"name": "CVE-2021-44446",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-44446"
},
{
"name": "CVE-2021-44010",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-44010"
},
{
"name": "CVE-2021-44522",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-44522"
},
{
"name": "CVE-2021-44448",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-44448"
},
{
"name": "CVE-2021-44523",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-44523"
},
{
"name": "CVE-2019-20840",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-20840"
},
{
"name": "CVE-2021-31346",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-31346"
},
{
"name": "CVE-2018-20750",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-20750"
},
{
"name": "CVE-2021-42022",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42022"
},
{
"name": "CVE-2021-44433",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-44433"
},
{
"name": "CVE-2021-44004",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-44004"
},
{
"name": "CVE-2017-18922",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-18922"
},
{
"name": "CVE-2021-44524",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-44524"
},
{
"name": "CVE-2021-44003",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-44003"
},
{
"name": "CVE-2021-44007",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-44007"
},
{
"name": "CVE-2021-42024",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42024"
},
{
"name": "CVE-2019-20839",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-20839"
},
{
"name": "CVE-2021-44431",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-44431"
},
{
"name": "CVE-2021-31889",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-31889"
},
{
"name": "CVE-2021-44005",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-44005"
},
{
"name": "CVE-2020-14402",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-14402"
},
{
"name": "CVE-2020-14397",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-14397"
},
{
"name": "CVE-2021-31883",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-31883"
},
{
"name": "CVE-2020-14398",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-14398"
},
{
"name": "CVE-2020-14403",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-14403"
},
{
"name": "CVE-2021-44439",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-44439"
},
{
"name": "CVE-2021-44015",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-44015"
},
{
"name": "CVE-2021-44437",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-44437"
},
{
"name": "CVE-2021-31886",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-31886"
},
{
"name": "CVE-2021-44450",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-44450"
},
{
"name": "CVE-2021-42027",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42027"
},
{
"name": "CVE-2021-31890",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-31890"
},
{
"name": "CVE-2020-14405",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-14405"
},
{
"name": "CVE-2021-31345",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-31345"
},
{
"name": "CVE-2018-20019",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-20019"
},
{
"name": "CVE-2018-15127",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-15127"
},
{
"name": "CVE-2018-21247",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-21247"
},
{
"name": "CVE-2021-44165",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-44165"
},
{
"name": "CVE-2021-31344",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-31344"
},
{
"name": "CVE-2020-14401",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-14401"
}
],
"links": [],
"reference": "CERTFR-2021-AVI-949",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2021-12-15T00:00:00.000000"
}
],
"risks": [
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "D\u00e9ni de service"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits\nSiemens. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer\nune ex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de service et un\ncontournement de la politique de s\u00e9curit\u00e9.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Siemens",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-620288 du 14 d\u00e9cembre 2021",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-620288.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-133772 du 14 d\u00e9cembre 2021",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-133772.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-199605 du 14 d\u00e9cembre 2021",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-199605.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-595101 du 14 d\u00e9cembre 2021",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-595101.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-496292 du 14 d\u00e9cembre 2021",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-496292.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-400332 du 14 d\u00e9cembre 2021",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-400332.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-463116 du 14 d\u00e9cembre 2021",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-463116.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-523250 du 14 d\u00e9cembre 2021",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-523250.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-352143 du 14 d\u00e9cembre 2021",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-352143.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-390195 du 14 d\u00e9cembre 2021",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-390195.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-396621 du 14 d\u00e9cembre 2021",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-396621.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-802578 du 14 d\u00e9cembre 2021",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-802578.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-160202 du 14 d\u00e9cembre 2021",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-160202.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-161331 du 14 d\u00e9cembre 2021",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-161331.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-114589 du 14 d\u00e9cembre 2021",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-114589.pdf"
}
]
}
CERTFR-2021-AVI-949
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été découvertes dans les produits Siemens. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service et un contournement de la politique de sécurité.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Siemens | N/A | APOGEE MEC (PPC) (BACnet) toutes versions | ||
| Siemens | N/A | SIMATIC eaSie PCS 7 Skill Package (6DL5424-0BX00-0AV8) versions antérieures à 21.00 SP3 | ||
| Siemens | N/A | Siveillance Identity V5 versions antérieures à 1.6.284, ou sans le correctif de sécurité SP5 | ||
| Siemens | N/A | SIMATIC ITC2200 V3 PRO versions antérieures à 3.2.1.0 | ||
| Siemens | N/A | Desigo PXC22.1-E.D toutes versions postérieures à 2.3 | ||
| Siemens | N/A | SINUMERIK Edge versions antérieures à 3.2 | ||
| Siemens | N/A | Desigo PXC36.1-E.D toutes versions postérieures à 2.3 | ||
| Siemens | N/A | Capital VSTAR toutes versions avec l'option Ethernet activée | ||
| Siemens | N/A | JTTK versions antérieures à 11.1.1.0 | ||
| Siemens | N/A | Teamcenter Active Workspace versions 5.2.x antérieures à 5.2.3 | ||
| Siemens | N/A | Desigo PXC00-E.D toutes versions postérieures à 2.3 | ||
| Siemens | N/A | POWER METER SICAM Q100 (7KG9501-0AA31-0AA1) versions antérieures à 2.41 | ||
| Siemens | N/A | Questa Simulation toutes versions | ||
| Siemens | N/A | Desigo PXC00-U toutes versions postérieures à 2.3 | ||
| Siemens | N/A | SIMATIC ITC1900 V3 PRO versions antérieures à 3.2.1.0 | ||
| Siemens | N/A | SIMATIC ITC1900 V3 versions antérieures à 3.2.1.0 | ||
| Siemens | N/A | SIMATIC ITC1500 V3 versions antérieures à 3.2.1.0 | ||
| Siemens | N/A | SIMATIC ITC2200 V3 versions antérieures à 3.2.1.0 | ||
| Siemens | N/A | JT Utilities versions antérieures à 13.1.1.0 | ||
| Siemens | N/A | POWER METER SICAM Q100 (7KG9501-0AA01-0AA1) versions antérieures à 2.41 | ||
| Siemens | N/A | Desigo PXC001-E.D toutes versions postérieures à 2.3 | ||
| Siemens | N/A | Desigo PXC64-U toutes versions postérieures à 2.3 | ||
| Siemens | N/A | Teamcenter Active Workspace versions 5.0.x antérieures à 5.0.10 | ||
| Siemens | N/A | ModelSim Simulation toutes versions | ||
| Siemens | N/A | Teamcenter Active Workspace versions 5.1.x antérieures à 5.1.6 | ||
| Siemens | N/A | Desigo PXC200-E.D toutes versions postérieures à 2.3 | ||
| Siemens | N/A | Desigo PXC12-E.D toutes versions postérieures à 2.3 | ||
| Siemens | N/A | Teamcenter Active Workspace versions 4.3.x antérieures à V4.3.11 | ||
| Siemens | N/A | SIMATIC ITC1500 V3 PRO versions antérieures à 3.2.1.0 | ||
| Siemens | N/A | JT Utilities versions antérieures à 12.8.1.1 | ||
| Siemens | N/A | SiPass integrated versions antérieures à 2.85 | ||
| Siemens | N/A | Teamcenter Visualization versions antérieures à 13.2.0.5 | ||
| Siemens | N/A | Desigo PXC22-E.D toutes versions postérieures à 2.3 | ||
| Siemens | N/A | JT Utilities versions antérieures à 13.0.3.0 | ||
| Siemens | N/A | Simcenter STAR-CCM+ Viewer versions antérieures à 2021.3.1 | ||
| Siemens | N/A | Siveillance Identity V1.6 versions antérieures à 1.6.284.0 | ||
| Siemens | N/A | JTTK versions antérieures à 10.8.1.1 | ||
| Siemens | N/A | POWER METER SICAM Q100 (7KG9501-0AA31-2AA1) versions antérieures à 2.41 | ||
| Siemens | N/A | Desigo PXC100-E.D toutes versions postérieures à 2.3 | ||
| Siemens | N/A | SiPass integrated versions antérieures à 2.76 | ||
| Siemens | N/A | Desigo PXC50-E.D toutes versions postérieures à 2.3 | ||
| Siemens | N/A | JT2Go versions antérieures à 13.2.0.5 | ||
| Siemens | N/A | JTTK versions antérieures à 11.0.3.0 | ||
| Siemens | N/A | Desigo PXC128-U toutes versions postérieures à 2.3 | ||
| Siemens | N/A | SiPass integrated versions antérieures à 2.80 | ||
| Siemens | N/A | APOGEE MBC (PPC) (P2 Ethernet) toutes versions | ||
| Siemens | N/A | APOGEE PXC Modular (BACnet) toutes versions | ||
| Siemens | N/A | APOGEE MBC (PPC) (BACnet) toutes versions | ||
| Siemens | N/A | APOGEE PXC Compact (BACnet) toutes versions | ||
| Siemens | N/A | APOGEE MEC (PPC) (P2 Ethernet) toutes versions | ||
| Siemens | N/A | APOGEE PXC Compact (P2 Ethernet) toutes versions | ||
| Siemens | N/A | APOGEE PXC Modular (P2 Ethernet) toutes versions | ||
| Siemens | N/A | POWER METER SICAM Q100 (7KG9501-0AA01-2AA1) versions antérieures à 2.41 |
References
| Title | Publication Time | Tags | |||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||||||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "APOGEE MEC (PPC) (BACnet) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC eaSie PCS 7 Skill Package (6DL5424-0BX00-0AV8) versions ant\u00e9rieures \u00e0 21.00 SP3",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Siveillance Identity V5 versions ant\u00e9rieures \u00e0 1.6.284, ou sans le correctif de s\u00e9curit\u00e9 SP5",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC ITC2200 V3 PRO versions ant\u00e9rieures \u00e0 3.2.1.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Desigo PXC22.1-E.D toutes versions post\u00e9rieures \u00e0 2.3",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SINUMERIK Edge versions ant\u00e9rieures \u00e0 3.2",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Desigo PXC36.1-E.D toutes versions post\u00e9rieures \u00e0 2.3",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Capital VSTAR toutes versions avec l\u0027option Ethernet activ\u00e9e",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "JTTK versions ant\u00e9rieures \u00e0 11.1.1.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Teamcenter Active Workspace versions 5.2.x ant\u00e9rieures \u00e0 5.2.3",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Desigo PXC00-E.D toutes versions post\u00e9rieures \u00e0 2.3",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "POWER METER SICAM Q100 (7KG9501-0AA31-0AA1) versions ant\u00e9rieures \u00e0 2.41",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Questa Simulation toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Desigo PXC00-U toutes versions post\u00e9rieures \u00e0 2.3",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC ITC1900 V3 PRO versions ant\u00e9rieures \u00e0 3.2.1.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC ITC1900 V3 versions ant\u00e9rieures \u00e0 3.2.1.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC ITC1500 V3 versions ant\u00e9rieures \u00e0 3.2.1.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC ITC2200 V3 versions ant\u00e9rieures \u00e0 3.2.1.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "JT Utilities versions ant\u00e9rieures \u00e0 13.1.1.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "POWER METER SICAM Q100 (7KG9501-0AA01-0AA1) versions ant\u00e9rieures \u00e0 2.41",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Desigo PXC001-E.D toutes versions post\u00e9rieures \u00e0 2.3",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Desigo PXC64-U toutes versions post\u00e9rieures \u00e0 2.3",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Teamcenter Active Workspace versions 5.0.x ant\u00e9rieures \u00e0 5.0.10",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "ModelSim Simulation toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Teamcenter Active Workspace versions 5.1.x ant\u00e9rieures \u00e0 5.1.6",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Desigo PXC200-E.D toutes versions post\u00e9rieures \u00e0 2.3",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Desigo PXC12-E.D toutes versions post\u00e9rieures \u00e0 2.3",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Teamcenter Active Workspace versions 4.3.x ant\u00e9rieures \u00e0 V4.3.11",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC ITC1500 V3 PRO versions ant\u00e9rieures \u00e0 3.2.1.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "JT Utilities versions ant\u00e9rieures \u00e0 12.8.1.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SiPass integrated versions ant\u00e9rieures \u00e0 2.85",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Teamcenter Visualization versions ant\u00e9rieures \u00e0 13.2.0.5",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Desigo PXC22-E.D toutes versions post\u00e9rieures \u00e0 2.3",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "JT Utilities versions ant\u00e9rieures \u00e0 13.0.3.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Simcenter STAR-CCM+ Viewer versions ant\u00e9rieures \u00e0 2021.3.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Siveillance Identity V1.6 versions ant\u00e9rieures \u00e0 1.6.284.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "JTTK versions ant\u00e9rieures \u00e0 10.8.1.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "POWER METER SICAM Q100 (7KG9501-0AA31-2AA1) versions ant\u00e9rieures \u00e0 2.41",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Desigo PXC100-E.D toutes versions post\u00e9rieures \u00e0 2.3",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SiPass integrated versions ant\u00e9rieures \u00e0 2.76",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Desigo PXC50-E.D toutes versions post\u00e9rieures \u00e0 2.3",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "JT2Go versions ant\u00e9rieures \u00e0 13.2.0.5",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "JTTK versions ant\u00e9rieures \u00e0 11.0.3.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Desigo PXC128-U toutes versions post\u00e9rieures \u00e0 2.3",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SiPass integrated versions ant\u00e9rieures \u00e0 2.80",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "APOGEE MBC (PPC) (P2 Ethernet) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "APOGEE PXC Modular (BACnet) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "APOGEE MBC (PPC) (BACnet) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "APOGEE PXC Compact (BACnet) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "APOGEE MEC (PPC) (P2 Ethernet) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "APOGEE PXC Compact (P2 Ethernet) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "APOGEE PXC Modular (P2 Ethernet) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "POWER METER SICAM Q100 (7KG9501-0AA01-2AA1) versions ant\u00e9rieures \u00e0 2.41",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2021-44443",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-44443"
},
{
"name": "CVE-2021-31881",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-31881"
},
{
"name": "CVE-2021-44444",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-44444"
},
{
"name": "CVE-2021-44009",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-44009"
},
{
"name": "CVE-2021-31888",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-31888"
},
{
"name": "CVE-2021-44447",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-44447"
},
{
"name": "CVE-2018-20749",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-20749"
},
{
"name": "CVE-2021-44013",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-44013"
},
{
"name": "CVE-2021-31885",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-31885"
},
{
"name": "CVE-2021-31887",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-31887"
},
{
"name": "CVE-2019-15690",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-15690"
},
{
"name": "CVE-2021-44012",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-44012"
},
{
"name": "CVE-2020-14396",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-14396"
},
{
"name": "CVE-2021-44001",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-44001"
},
{
"name": "CVE-2020-14404",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-14404"
},
{
"name": "CVE-2021-44430",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-44430"
},
{
"name": "CVE-2021-44440",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-44440"
},
{
"name": "CVE-2021-44432",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-44432"
},
{
"name": "CVE-2021-44445",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-44445"
},
{
"name": "CVE-2021-31884",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-31884"
},
{
"name": "CVE-2021-44434",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-44434"
},
{
"name": "CVE-2021-44449",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-44449"
},
{
"name": "CVE-2019-15681",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-15681"
},
{
"name": "CVE-2021-44435",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-44435"
},
{
"name": "CVE-2021-42023",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42023"
},
{
"name": "CVE-2021-44442",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-44442"
},
{
"name": "CVE-2021-44002",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-44002"
},
{
"name": "CVE-2021-44014",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-44014"
},
{
"name": "CVE-2021-44436",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-44436"
},
{
"name": "CVE-2021-31882",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-31882"
},
{
"name": "CVE-2021-44438",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-44438"
},
{
"name": "CVE-2021-44006",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-44006"
},
{
"name": "CVE-2021-41547",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-41547"
},
{
"name": "CVE-2021-44008",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-44008"
},
{
"name": "CVE-2021-44017",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-44017"
},
{
"name": "CVE-2021-44441",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-44441"
},
{
"name": "CVE-2021-44011",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-44011"
},
{
"name": "CVE-2018-20748",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-20748"
},
{
"name": "CVE-2019-20788",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-20788"
},
{
"name": "CVE-2021-44446",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-44446"
},
{
"name": "CVE-2021-44010",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-44010"
},
{
"name": "CVE-2021-44522",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-44522"
},
{
"name": "CVE-2021-44448",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-44448"
},
{
"name": "CVE-2021-44523",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-44523"
},
{
"name": "CVE-2019-20840",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-20840"
},
{
"name": "CVE-2021-31346",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-31346"
},
{
"name": "CVE-2018-20750",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-20750"
},
{
"name": "CVE-2021-42022",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42022"
},
{
"name": "CVE-2021-44433",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-44433"
},
{
"name": "CVE-2021-44004",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-44004"
},
{
"name": "CVE-2017-18922",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-18922"
},
{
"name": "CVE-2021-44524",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-44524"
},
{
"name": "CVE-2021-44003",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-44003"
},
{
"name": "CVE-2021-44007",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-44007"
},
{
"name": "CVE-2021-42024",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42024"
},
{
"name": "CVE-2019-20839",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-20839"
},
{
"name": "CVE-2021-44431",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-44431"
},
{
"name": "CVE-2021-31889",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-31889"
},
{
"name": "CVE-2021-44005",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-44005"
},
{
"name": "CVE-2020-14402",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-14402"
},
{
"name": "CVE-2020-14397",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-14397"
},
{
"name": "CVE-2021-31883",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-31883"
},
{
"name": "CVE-2020-14398",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-14398"
},
{
"name": "CVE-2020-14403",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-14403"
},
{
"name": "CVE-2021-44439",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-44439"
},
{
"name": "CVE-2021-44015",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-44015"
},
{
"name": "CVE-2021-44437",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-44437"
},
{
"name": "CVE-2021-31886",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-31886"
},
{
"name": "CVE-2021-44450",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-44450"
},
{
"name": "CVE-2021-42027",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42027"
},
{
"name": "CVE-2021-31890",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-31890"
},
{
"name": "CVE-2020-14405",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-14405"
},
{
"name": "CVE-2021-31345",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-31345"
},
{
"name": "CVE-2018-20019",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-20019"
},
{
"name": "CVE-2018-15127",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-15127"
},
{
"name": "CVE-2018-21247",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-21247"
},
{
"name": "CVE-2021-44165",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-44165"
},
{
"name": "CVE-2021-31344",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-31344"
},
{
"name": "CVE-2020-14401",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-14401"
}
],
"links": [],
"reference": "CERTFR-2021-AVI-949",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2021-12-15T00:00:00.000000"
}
],
"risks": [
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "D\u00e9ni de service"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits\nSiemens. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer\nune ex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de service et un\ncontournement de la politique de s\u00e9curit\u00e9.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Siemens",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-620288 du 14 d\u00e9cembre 2021",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-620288.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-133772 du 14 d\u00e9cembre 2021",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-133772.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-199605 du 14 d\u00e9cembre 2021",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-199605.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-595101 du 14 d\u00e9cembre 2021",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-595101.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-496292 du 14 d\u00e9cembre 2021",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-496292.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-400332 du 14 d\u00e9cembre 2021",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-400332.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-463116 du 14 d\u00e9cembre 2021",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-463116.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-523250 du 14 d\u00e9cembre 2021",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-523250.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-352143 du 14 d\u00e9cembre 2021",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-352143.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-390195 du 14 d\u00e9cembre 2021",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-390195.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-396621 du 14 d\u00e9cembre 2021",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-396621.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-802578 du 14 d\u00e9cembre 2021",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-802578.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-160202 du 14 d\u00e9cembre 2021",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-160202.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-161331 du 14 d\u00e9cembre 2021",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-161331.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-114589 du 14 d\u00e9cembre 2021",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-114589.pdf"
}
]
}
FKIE_CVE-2021-44009
Vulnerability from fkie_nvd - Published: 2021-12-14 12:15 - Updated: 2024-11-21 06:30
Severity ?
Summary
A vulnerability has been identified in JT2Go (All versions < V13.2.0.5), Teamcenter Visualization (All versions < V13.2.0.5). The Tiff_Loader.dll is vulnerable to an out of bounds read past the end of an allocated buffer when parsing TIFF files. An attacker could leverage this vulnerability to leak information in the context of the current process.
References
| URL | Tags | ||
|---|---|---|---|
| productcert@siemens.com | https://cert-portal.siemens.com/productcert/pdf/ssa-595101.pdf | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://cert-portal.siemens.com/productcert/pdf/ssa-595101.pdf | Patch, Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| siemens | jt2go | * | |
| siemens | teamcenter_visualization | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:siemens:jt2go:*:*:*:*:*:*:*:*",
"matchCriteriaId": "16503D23-333C-4282-B4FE-EF51ED89209A",
"versionEndExcluding": "13.2.0.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:siemens:teamcenter_visualization:*:*:*:*:*:*:*:*",
"matchCriteriaId": "6C1C132F-3514-40F7-B7F9-D4FD8C36029A",
"versionEndExcluding": "13.2.0.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability has been identified in JT2Go (All versions \u003c V13.2.0.5), Teamcenter Visualization (All versions \u003c V13.2.0.5). The Tiff_Loader.dll is vulnerable to an out of bounds read past the end of an allocated buffer when parsing TIFF files. An attacker could leverage this vulnerability to leak information in the context of the current process."
},
{
"lang": "es",
"value": "Se ha identificado una vulnerabilidad en JT2Go (Todas las versiones anteriores a V13.2.0.5), Teamcenter Visualization (Todas las versiones anteriores a V13.2.0.5). El archivo Tiff_Loader.dll es vulnerable a una lectura fuera de l\u00edmites m\u00e1s all\u00e1 del final de un b\u00fafer asignado al analizar archivos TIFF. Un atacante podr\u00eda aprovechar esta vulnerabilidad para filtrar informaci\u00f3n en el contexto del proceso actual"
}
],
"id": "CVE-2021-44009",
"lastModified": "2024-11-21T06:30:12.190",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2021-12-14T12:15:10.510",
"references": [
{
"source": "productcert@siemens.com",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-595101.pdf"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-595101.pdf"
}
],
"sourceIdentifier": "productcert@siemens.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-125"
}
],
"source": "productcert@siemens.com",
"type": "Primary"
}
]
}
VAR-202112-0800
Vulnerability from variot - Updated: 2023-12-18 11:21A vulnerability has been identified in JT2Go (All versions < V13.2.0.5), Teamcenter Visualization (All versions < V13.2.0.5). The Tiff_Loader.dll is vulnerable to an out of bounds read past the end of an allocated buffer when parsing TIFF files. An attacker could leverage this vulnerability to leak information in the context of the current process.
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-202112-0800",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "jt2go",
"scope": "lt",
"trust": 1.0,
"vendor": "siemens",
"version": "13.2.0.5"
},
{
"model": "teamcenter visualization",
"scope": "lt",
"trust": 1.0,
"vendor": "siemens",
"version": "13.2.0.5"
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2021-44009"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:siemens:jt2go:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "13.2.0.5",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:siemens:teamcenter_visualization:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "13.2.0.5",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2021-44009"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Mat Powell of Trend Micro\u2019s Zero Day Initiative and Jin Huang from ADLab reported these vulnerabilities.",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202112-1200"
}
],
"trust": 0.6
},
"cve": "CVE-2021-44009",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"integrityImpact": "NONE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"trust": 1.0,
"userInteractionRequired": true,
"vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"author": "NVD",
"availabilityImpact": "NONE",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 1.8,
"impactScore": 3.6,
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
}
],
"severity": [
{
"author": "NVD",
"id": "CVE-2021-44009",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-202112-1200",
"trust": 0.6,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2021-44009"
},
{
"db": "CNNVD",
"id": "CNNVD-202112-1200"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "A vulnerability has been identified in JT2Go (All versions \u003c V13.2.0.5), Teamcenter Visualization (All versions \u003c V13.2.0.5). The Tiff_Loader.dll is vulnerable to an out of bounds read past the end of an allocated buffer when parsing TIFF files. An attacker could leverage this vulnerability to leak information in the context of the current process.",
"sources": [
{
"db": "NVD",
"id": "CVE-2021-44009"
}
],
"trust": 1.0
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "SIEMENS",
"id": "SSA-595101",
"trust": 1.6
},
{
"db": "NVD",
"id": "CVE-2021-44009",
"trust": 1.6
},
{
"db": "CS-HELP",
"id": "SB2022010614",
"trust": 0.6
},
{
"db": "ICS CERT",
"id": "ICSA-21-350-10",
"trust": 0.6
},
{
"db": "AUSCERT",
"id": "ESB-2021.4300",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-202112-1200",
"trust": 0.6
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2021-44009"
},
{
"db": "CNNVD",
"id": "CNNVD-202112-1200"
}
]
},
"id": "VAR-202112-0800",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VARIoT devices database",
"id": null
}
],
"trust": 0.15799868
},
"last_update_date": "2023-12-18T11:21:46.831000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Siemens Jt2go Buffer error vulnerability fix",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=174915"
}
],
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202112-1200"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-125",
"trust": 1.0
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2021-44009"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.6,
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-595101.pdf"
},
{
"trust": 0.6,
"url": "https://us-cert.cisa.gov/ics/advisories/icsa-21-350-10"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2021.4300"
},
{
"trust": 0.6,
"url": "https://www.cybersecurity-help.cz/vdb/sb2022010614"
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2021-44009"
},
{
"db": "CNNVD",
"id": "CNNVD-202112-1200"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2021-44009"
},
{
"db": "CNNVD",
"id": "CNNVD-202112-1200"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2021-12-14T12:15:10.510000",
"db": "NVD",
"id": "CVE-2021-44009"
},
{
"date": "2021-12-14T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202112-1200"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2021-12-15T13:23:30.857000",
"db": "NVD",
"id": "CVE-2021-44009"
},
{
"date": "2022-01-07T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202112-1200"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "local",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202112-1200"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Siemens Jt2go Buffer error vulnerability",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202112-1200"
}
],
"trust": 0.6
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "buffer error",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202112-1200"
}
],
"trust": 0.6
}
}
ICSA-21-350-10
Vulnerability from csaf_cisa - Published: 2021-12-14 00:00 - Updated: 2025-05-06 06:00Summary
Siemens JT2Go and Teamcenter Visualization
Notes
Summary
Siemens has released version V13.2.0.5 for JT2Go and Teamcenter Visualization to fix multiple vulnerabilities that could be triggered when the products read maliciously crafted files in different file formats (PDF, JT, TIFF, CGM and TIF). If a user is tricked to open a malicious file with any of the affected products, this could lead the application to crash or potentially lead to arbitrary code execution.
Siemens recommends to update to the latest versions and to limit opening of untrusted files from unknown sources in the affected products.
General Recommendations
As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.
Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity
Additional Resources
For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories
Terms of Use
Siemens Security Advisories are subject to the terms and conditions contained in Siemens' underlying license terms or other applicable agreements previously agreed to with Siemens (hereinafter "License Terms"). To the extent applicable to information, software or documentation made available in or through a Siemens Security Advisory, the Terms of Use of Siemens' Global Website (https://www.siemens.com/terms_of_use, hereinafter "Terms of Use"), in particular Sections 8-10 of the Terms of Use, shall apply additionally. In case of conflicts, the License Terms shall prevail over the Terms of Use.
Legal Notice
All information products included in https://us-cert.cisa.gov/ics are provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.
Advisory Conversion Disclaimer
This CISA CSAF advisory was converted from Siemens ProductCERT's CSAF advisory.
Critical infrastructure sectors
Multiple
Countries/areas deployed
Worldwide
Company headquarters location
Germany
Recommended Practices
CISA recommends users take defensive measures to minimize the exploitation risk of this vulnerability.
Recommended Practices
Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.
Recommended Practices
Locate control system networks and remote devices behind firewalls and isolate them from business networks.
Recommended Practices
When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.
Recommended Practices
CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
Recommended Practices
CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
Recommended Practices
CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
Recommended Practices
Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
{
"document": {
"acknowledgments": [
{
"organization": "Siemens ProductCERT",
"summary": "reporting this vulnerability to CISA."
},
{
"organization": "Trend Micro Zero Day Initiative",
"summary": "coordinated disclosure of CVE-2021-44001, CVE-2021-44002, CVE-2021-44017 and CVE-2021-44011 through CVE-2021-44015"
},
{
"organization": "Cybersecurity and Infrastructure Security Agency (CISA)",
"summary": "coordinated disclosure"
},
{
"names": [
"Jin Huang"
],
"organization": "ADLab of Venustech",
"summary": "reporting the vulnerabilities from CVE-2021-44003 through CVE-2021-44010"
}
],
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Disclosure is not limited",
"tlp": {
"label": "WHITE",
"url": "https://us-cert.cisa.gov/tlp/"
}
},
"notes": [
{
"category": "summary",
"text": "Siemens has released version V13.2.0.5 for JT2Go and Teamcenter Visualization to fix multiple vulnerabilities that could be triggered when the products read maliciously crafted files in different file formats (PDF, JT, TIFF, CGM and TIF). If a user is tricked to open a malicious file with any of the affected products, this could lead the application to crash or potentially lead to arbitrary code execution.\n\nSiemens recommends to update to the latest versions and to limit opening of untrusted files from unknown sources in the affected products.",
"title": "Summary"
},
{
"category": "general",
"text": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\n\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity",
"title": "General Recommendations"
},
{
"category": "general",
"text": "For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories",
"title": "Additional Resources"
},
{
"category": "legal_disclaimer",
"text": "Siemens Security Advisories are subject to the terms and conditions contained in Siemens\u0027 underlying license terms or other applicable agreements previously agreed to with Siemens (hereinafter \"License Terms\"). To the extent applicable to information, software or documentation made available in or through a Siemens Security Advisory, the Terms of Use of Siemens\u0027 Global Website (https://www.siemens.com/terms_of_use, hereinafter \"Terms of Use\"), in particular Sections 8-10 of the Terms of Use, shall apply additionally. In case of conflicts, the License Terms shall prevail over the Terms of Use.",
"title": "Terms of Use"
},
{
"category": "legal_disclaimer",
"text": "All information products included in https://us-cert.cisa.gov/ics are provided \"as is\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.",
"title": "Legal Notice"
},
{
"category": "other",
"text": "This CISA CSAF advisory was converted from Siemens ProductCERT\u0027s CSAF advisory.",
"title": "Advisory Conversion Disclaimer"
},
{
"category": "other",
"text": "Multiple",
"title": "Critical infrastructure sectors"
},
{
"category": "other",
"text": "Worldwide",
"title": "Countries/areas deployed"
},
{
"category": "other",
"text": "Germany",
"title": "Company headquarters location"
},
{
"category": "general",
"text": "CISA recommends users take defensive measures to minimize the exploitation risk of this vulnerability.",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "Locate control system networks and remote devices behind firewalls and isolate them from business networks.",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.",
"title": "Recommended Practices"
}
],
"publisher": {
"category": "other",
"contact_details": "central@cisa.dhs.gov",
"name": "CISA",
"namespace": "https://www.cisa.gov/"
},
"references": [
{
"category": "self",
"summary": "SSA-595101: Multiple File Parsing Vulnerabilities in JT2Go and Teamcenter Visualization before V13.2.0.5 - CSAF Version",
"url": "https://cert-portal.siemens.com/productcert/csaf/ssa-595101.json"
},
{
"category": "self",
"summary": "SSA-595101: Multiple File Parsing Vulnerabilities in JT2Go and Teamcenter Visualization before V13.2.0.5 - TXT Version",
"url": "https://cert-portal.siemens.com/productcert/txt/ssa-595101.txt"
},
{
"category": "self",
"summary": "SSA-595101: Multiple File Parsing Vulnerabilities in JT2Go and Teamcenter Visualization before V13.2.0.5 - PDF Version",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-595101.pdf"
},
{
"category": "self",
"summary": "ICS Advisory ICSA-21-350-10 JSON",
"url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2021/icsa-21-350-10.json"
},
{
"category": "self",
"summary": "ICS Advisory ICSA-21-350-10 - Web Version",
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-21-350-10"
},
{
"category": "external",
"summary": "Recommended Practices",
"url": "https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01"
},
{
"category": "external",
"summary": "Recommended Practices",
"url": "https://www.cisa.gov/resources-tools/resources/ics-recommended-practices"
},
{
"category": "external",
"summary": "Recommended Practices",
"url": "https://www.cisa.gov/topics/industrial-control-systems"
},
{
"category": "external",
"summary": "Recommended Practices",
"url": "https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf"
},
{
"category": "external",
"summary": "Recommended Practices",
"url": "https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf"
},
{
"category": "external",
"summary": "Recommended Practices",
"url": "https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B"
}
],
"title": "Siemens JT2Go and Teamcenter Visualization",
"tracking": {
"current_release_date": "2025-05-06T06:00:00.000000Z",
"generator": {
"engine": {
"name": "CISA CSAF Generator",
"version": "1.0.0"
}
},
"id": "ICSA-21-350-10",
"initial_release_date": "2021-12-14T00:00:00.000000Z",
"revision_history": [
{
"date": "2021-12-14T00:00:00.000000Z",
"legacy_version": "1.0",
"number": "1",
"summary": "Publication Date"
},
{
"date": "2025-05-06T06:00:00.000000Z",
"legacy_version": "Revision",
"number": "2",
"summary": "Revision - Fixing typos"
}
],
"status": "final",
"version": "2"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "\u003cV13.2.0.5",
"product": {
"name": "JT2Go",
"product_id": "CSAFPID-0001"
}
}
],
"category": "product_name",
"name": "JT2Go"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003cV13.2.0.5",
"product": {
"name": "Teamcenter Visualization",
"product_id": "CSAFPID-0002"
}
}
],
"category": "product_name",
"name": "Teamcenter Visualization"
}
],
"category": "vendor",
"name": "Siemens"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2021-44001",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "summary",
"text": "The DL180pdfl.dll contains an out of bounds write past the end of an allocated structure while parsing specially crafted PDF files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-14974)",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
"references": [
{
"summary": "CVE-2021-44001 - JT2Go",
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"summary": "CVE-2021-44001 - Teamcenter Visualization",
"url": "https://support.sw.siemens.com/"
},
{
"summary": "CVE-2021-44001 Mitre 5.0 json",
"url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2021-44001.json"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V13.2.0.5 or later version",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"category": "vendor_fix",
"details": "Update to V13.2.0.5 or later version",
"product_ids": [
"CSAFPID-0002"
],
"url": "https://support.sw.siemens.com/"
},
{
"category": "mitigation",
"details": "Avoid to open untrusted files from unknown sources in JT2Go and Teamcenter Visualization",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
],
"title": "CVE-2021-44001"
},
{
"cve": "CVE-2021-44002",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "summary",
"text": "The Jt1001.dll contains an out of bounds write past the end of an allocated structure while parsing specially crafted JT files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-15058)",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
"references": [
{
"summary": "CVE-2021-44002 - JT2Go",
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"summary": "CVE-2021-44002 - Teamcenter Visualization",
"url": "https://support.sw.siemens.com/"
},
{
"summary": "CVE-2021-44002 Mitre 5.0 json",
"url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2021-44002.json"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V13.2.0.5 or later version",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"category": "vendor_fix",
"details": "Update to V13.2.0.5 or later version",
"product_ids": [
"CSAFPID-0002"
],
"url": "https://support.sw.siemens.com/"
},
{
"category": "mitigation",
"details": "Avoid to open untrusted files from unknown sources in JT2Go and Teamcenter Visualization",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
],
"title": "CVE-2021-44002"
},
{
"cve": "CVE-2021-44003",
"cwe": {
"id": "CWE-457",
"name": "Use of Uninitialized Variable"
},
"notes": [
{
"category": "summary",
"text": "The Tiff_Loader.dll is vulnerable to use of uninitialized memory while parsing user supplied TIFF files. This could allow an attacker to cause a denial-of-service condition.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
"references": [
{
"summary": "CVE-2021-44003 - JT2Go",
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"summary": "CVE-2021-44003 - Teamcenter Visualization",
"url": "https://support.sw.siemens.com/"
},
{
"summary": "CVE-2021-44003 Mitre 5.0 json",
"url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2021-44003.json"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V13.2.0.5 or later version",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"category": "vendor_fix",
"details": "Update to V13.2.0.5 or later version",
"product_ids": [
"CSAFPID-0002"
],
"url": "https://support.sw.siemens.com/"
},
{
"category": "mitigation",
"details": "Avoid to open untrusted files from unknown sources in JT2Go and Teamcenter Visualization",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
],
"title": "CVE-2021-44003"
},
{
"cve": "CVE-2021-44004",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"notes": [
{
"category": "summary",
"text": "The Tiff_Loader.dll is vulnerable to an out of bounds read past the end of an allocated buffer when parsing TIFF files. An attacker could leverage this vulnerability to leak information in the context of the current process.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
"references": [
{
"summary": "CVE-2021-44004 - JT2Go",
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"summary": "CVE-2021-44004 - Teamcenter Visualization",
"url": "https://support.sw.siemens.com/"
},
{
"summary": "CVE-2021-44004 Mitre 5.0 json",
"url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2021-44004.json"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V13.2.0.5 or later version",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"category": "vendor_fix",
"details": "Update to V13.2.0.5 or later version",
"product_ids": [
"CSAFPID-0002"
],
"url": "https://support.sw.siemens.com/"
},
{
"category": "mitigation",
"details": "Avoid to open untrusted files from unknown sources in JT2Go and Teamcenter Visualization",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
],
"title": "CVE-2021-44004"
},
{
"cve": "CVE-2021-44005",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "summary",
"text": "The Tiff_Loader.dll contains an out of bounds write past the end of an allocated structure while parsing specially crafted TIFF files. This could allow an attacker to execute code in the context of the current process.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
"references": [
{
"summary": "CVE-2021-44005 - JT2Go",
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"summary": "CVE-2021-44005 - Teamcenter Visualization",
"url": "https://support.sw.siemens.com/"
},
{
"summary": "CVE-2021-44005 Mitre 5.0 json",
"url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2021-44005.json"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V13.2.0.5 or later version",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"category": "vendor_fix",
"details": "Update to V13.2.0.5 or later version",
"product_ids": [
"CSAFPID-0002"
],
"url": "https://support.sw.siemens.com/"
},
{
"category": "mitigation",
"details": "Avoid to open untrusted files from unknown sources in JT2Go and Teamcenter Visualization",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
],
"title": "CVE-2021-44005"
},
{
"cve": "CVE-2021-44006",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "summary",
"text": "The Tiff_Loader.dll contains an out of bounds write past the end of an allocated structure while parsing specially crafted TIFF files. This could allow an attacker to execute code in the context of the current process.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
"references": [
{
"summary": "CVE-2021-44006 - JT2Go",
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"summary": "CVE-2021-44006 - Teamcenter Visualization",
"url": "https://support.sw.siemens.com/"
},
{
"summary": "CVE-2021-44006 Mitre 5.0 json",
"url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2021-44006.json"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V13.2.0.5 or later version",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"category": "vendor_fix",
"details": "Update to V13.2.0.5 or later version",
"product_ids": [
"CSAFPID-0002"
],
"url": "https://support.sw.siemens.com/"
},
{
"category": "mitigation",
"details": "Avoid to open untrusted files from unknown sources in JT2Go and Teamcenter Visualization",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
],
"title": "CVE-2021-44006"
},
{
"cve": "CVE-2021-44007",
"cwe": {
"id": "CWE-193",
"name": "Off-by-one Error"
},
"notes": [
{
"category": "summary",
"text": "The Tiff_Loader.dll contains an off-by-one error in the heap while parsing specially crafted TIFF files. This could allow an attacker to cause a denial-of-service condition.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
"references": [
{
"summary": "CVE-2021-44007 - JT2Go",
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"summary": "CVE-2021-44007 - Teamcenter Visualization",
"url": "https://support.sw.siemens.com/"
},
{
"summary": "CVE-2021-44007 Mitre 5.0 json",
"url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2021-44007.json"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V13.2.0.5 or later version",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"category": "vendor_fix",
"details": "Update to V13.2.0.5 or later version",
"product_ids": [
"CSAFPID-0002"
],
"url": "https://support.sw.siemens.com/"
},
{
"category": "mitigation",
"details": "Avoid to open untrusted files from unknown sources in JT2Go and Teamcenter Visualization",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
],
"title": "CVE-2021-44007"
},
{
"cve": "CVE-2021-44008",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"notes": [
{
"category": "summary",
"text": "The Tiff_Loader.dll is vulnerable to an out of bounds read past the end of an allocated buffer when parsing TIFF files. An attacker could leverage this vulnerability to leak information in the context of the current process.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
"references": [
{
"summary": "CVE-2021-44008 - JT2Go",
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"summary": "CVE-2021-44008 - Teamcenter Visualization",
"url": "https://support.sw.siemens.com/"
},
{
"summary": "CVE-2021-44008 Mitre 5.0 json",
"url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2021-44008.json"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V13.2.0.5 or later version",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"category": "vendor_fix",
"details": "Update to V13.2.0.5 or later version",
"product_ids": [
"CSAFPID-0002"
],
"url": "https://support.sw.siemens.com/"
},
{
"category": "mitigation",
"details": "Avoid to open untrusted files from unknown sources in JT2Go and Teamcenter Visualization",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
],
"title": "CVE-2021-44008"
},
{
"cve": "CVE-2021-44009",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"notes": [
{
"category": "summary",
"text": "The Tiff_Loader.dll is vulnerable to an out of bounds read past the end of an allocated buffer when parsing TIFF files. An attacker could leverage this vulnerability to leak information in the context of the current process.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
"references": [
{
"summary": "CVE-2021-44009 - JT2Go",
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"summary": "CVE-2021-44009 - Teamcenter Visualization",
"url": "https://support.sw.siemens.com/"
},
{
"summary": "CVE-2021-44009 Mitre 5.0 json",
"url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2021-44009.json"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V13.2.0.5 or later version",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"category": "vendor_fix",
"details": "Update to V13.2.0.5 or later version",
"product_ids": [
"CSAFPID-0002"
],
"url": "https://support.sw.siemens.com/"
},
{
"category": "mitigation",
"details": "Avoid to open untrusted files from unknown sources in JT2Go and Teamcenter Visualization",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
],
"title": "CVE-2021-44009"
},
{
"cve": "CVE-2021-44010",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"notes": [
{
"category": "summary",
"text": "The Tiff_Loader.dll is vulnerable to an out of bounds read past the end of an allocated buffer when parsing TIFF files. An attacker could leverage this vulnerability to leak information in the context of the current process.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
"references": [
{
"summary": "CVE-2021-44010 - JT2Go",
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"summary": "CVE-2021-44010 - Teamcenter Visualization",
"url": "https://support.sw.siemens.com/"
},
{
"summary": "CVE-2021-44010 Mitre 5.0 json",
"url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2021-44010.json"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V13.2.0.5 or later version",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"category": "vendor_fix",
"details": "Update to V13.2.0.5 or later version",
"product_ids": [
"CSAFPID-0002"
],
"url": "https://support.sw.siemens.com/"
},
{
"category": "mitigation",
"details": "Avoid to open untrusted files from unknown sources in JT2Go and Teamcenter Visualization",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
],
"title": "CVE-2021-44010"
},
{
"cve": "CVE-2021-44011",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"notes": [
{
"category": "summary",
"text": "The Jt1001.dll is vulnerable to an out of bounds read past the end of an allocated buffer while parsing specially crafted JT files. An attacker could leverage this vulnerability to leak information in the context of the current process. (ZDI-CAN-15101)",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
"references": [
{
"summary": "CVE-2021-44011 - JT2Go",
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"summary": "CVE-2021-44011 - Teamcenter Visualization",
"url": "https://support.sw.siemens.com/"
},
{
"summary": "CVE-2021-44011 Mitre 5.0 json",
"url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2021-44011.json"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V13.2.0.5 or later version",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"category": "vendor_fix",
"details": "Update to V13.2.0.5 or later version",
"product_ids": [
"CSAFPID-0002"
],
"url": "https://support.sw.siemens.com/"
},
{
"category": "mitigation",
"details": "Avoid to open untrusted files from unknown sources in JT2Go and Teamcenter Visualization",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
],
"title": "CVE-2021-44011"
},
{
"cve": "CVE-2021-44012",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"notes": [
{
"category": "summary",
"text": "The Jt1001.dll is vulnerable to an out of bounds read past the end of an allocated buffer when parsing specially crafted JT files. An attacker could leverage this vulnerability to leak information in the context of the current process. (ZDI-CAN-15102)",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
"references": [
{
"summary": "CVE-2021-44012 - JT2Go",
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"summary": "CVE-2021-44012 - Teamcenter Visualization",
"url": "https://support.sw.siemens.com/"
},
{
"summary": "CVE-2021-44012 Mitre 5.0 json",
"url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2021-44012.json"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V13.2.0.5 or later version",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"category": "vendor_fix",
"details": "Update to V13.2.0.5 or later version",
"product_ids": [
"CSAFPID-0002"
],
"url": "https://support.sw.siemens.com/"
},
{
"category": "mitigation",
"details": "Avoid to open untrusted files from unknown sources in JT2Go and Teamcenter Visualization",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
],
"title": "CVE-2021-44012"
},
{
"cve": "CVE-2021-44013",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "summary",
"text": "The DL180pdfl.dll contains an out of bounds write past the end of an allocated structure while parsing specially crafted JT files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-15103)",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
"references": [
{
"summary": "CVE-2021-44013 - JT2Go",
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"summary": "CVE-2021-44013 - Teamcenter Visualization",
"url": "https://support.sw.siemens.com/"
},
{
"summary": "CVE-2021-44013 Mitre 5.0 json",
"url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2021-44013.json"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V13.2.0.5 or later version",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"category": "vendor_fix",
"details": "Update to V13.2.0.5 or later version",
"product_ids": [
"CSAFPID-0002"
],
"url": "https://support.sw.siemens.com/"
},
{
"category": "mitigation",
"details": "Avoid to open untrusted files from unknown sources in JT2Go and Teamcenter Visualization",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
],
"title": "CVE-2021-44013"
},
{
"cve": "CVE-2021-44014",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "summary",
"text": "The Jt1001.dll contains a use-after-free vulnerability that could be triggered while parsing specially crafted JT files. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-15057)",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
"references": [
{
"summary": "CVE-2021-44014 - JT2Go",
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"summary": "CVE-2021-44014 - Teamcenter Visualization",
"url": "https://support.sw.siemens.com/"
},
{
"summary": "CVE-2021-44014 Mitre 5.0 json",
"url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2021-44014.json"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V13.2.0.5 or later version",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"category": "vendor_fix",
"details": "Update to V13.2.0.5 or later version",
"product_ids": [
"CSAFPID-0002"
],
"url": "https://support.sw.siemens.com/"
},
{
"category": "mitigation",
"details": "Avoid to open untrusted files from unknown sources in JT2Go and Teamcenter Visualization",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
],
"title": "CVE-2021-44014"
},
{
"cve": "CVE-2021-44015",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"notes": [
{
"category": "summary",
"text": "The VCRUNTIME140.dll is vulnerable to an out of bounds read past the end of an allocated buffer when parsing specially crafted CGM files. An attacker could leverage this vulnerability to leak information in the context of the current process. (ZDI-CAN-15109)",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
"references": [
{
"summary": "CVE-2021-44015 - JT2Go",
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"summary": "CVE-2021-44015 - Teamcenter Visualization",
"url": "https://support.sw.siemens.com/"
},
{
"summary": "CVE-2021-44015 Mitre 5.0 json",
"url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2021-44015.json"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V13.2.0.5 or later version",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"category": "vendor_fix",
"details": "Update to V13.2.0.5 or later version",
"product_ids": [
"CSAFPID-0002"
],
"url": "https://support.sw.siemens.com/"
},
{
"category": "mitigation",
"details": "Avoid to open untrusted files from unknown sources in JT2Go and Teamcenter Visualization",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
],
"title": "CVE-2021-44015"
},
{
"cve": "CVE-2021-44017",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"notes": [
{
"category": "summary",
"text": "The Image.dll is vulnerable to an out of bounds read past the end of an allocated buffer when parsing specially crafted TIF files. An attacker could leverage this vulnerability to leak information in the context of the current process. (ZDI-CAN-15111)",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
"references": [
{
"summary": "CVE-2021-44017 - JT2Go",
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"summary": "CVE-2021-44017 - Teamcenter Visualization",
"url": "https://support.sw.siemens.com/"
},
{
"summary": "CVE-2021-44017 Mitre 5.0 json",
"url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2021-44017.json"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V13.2.0.5 or later version",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"category": "vendor_fix",
"details": "Update to V13.2.0.5 or later version",
"product_ids": [
"CSAFPID-0002"
],
"url": "https://support.sw.siemens.com/"
},
{
"category": "mitigation",
"details": "Avoid to open untrusted files from unknown sources in JT2Go and Teamcenter Visualization",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
],
"title": "CVE-2021-44017"
}
]
}
CNVD-2021-100359
Vulnerability from cnvd - Published: 2021-12-16
VLAI Severity ?
Title
JT2Go和Teamcenter Visualization文件解析漏洞（CNVD-2021-100359）
Description
JT2Go是一个3D JT查看工具，Teamcenter可视化软件使企业能够通过一个全面的可视化解决方案系列来增强其产品生命周期管理(PLM)环境。该软件允许企业用户在单一环境中访问文档、2D图纸和3D模型。
JT2Go和Teamcenter Visualization文件解析漏洞，攻击者可利用该漏洞获取敏感信息。
Severity
低
Patch Name
JT2Go和Teamcenter Visualization文件解析漏洞（CNVD-2021-100359）的补丁
Patch Description
JT2Go是一个3D JT查看工具，Teamcenter可视化软件使企业能够通过一个全面的可视化解决方案系列来增强其产品生命周期管理(PLM)环境。该软件允许企业用户在单一环境中访问文档、2D图纸和3D模型。
JT2Go和Teamcenter Visualization文件解析漏洞，攻击者可利用该漏洞获取敏感信息。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。
Formal description
厂商已提供漏洞修补方案，请关注厂商主页及时更新： https://cert-portal.siemens.com/productcert/pdf/ssa-595101.pdf
Reference
https://cert-portal.siemens.com/productcert/pdf/ssa-595101.pdf
Impacted products
| Name | SIEMENS Teamcenter Visualization <V13.2.0.5 |
|---|
{
"cves": {
"cve": {
"cveNumber": "CVE-2021-44009"
}
},
"description": "JT2Go\u662f\u4e00\u4e2a3D JT\u67e5\u770b\u5de5\u5177\uff0cTeamcenter\u53ef\u89c6\u5316\u8f6f\u4ef6\u4f7f\u4f01\u4e1a\u80fd\u591f\u901a\u8fc7\u4e00\u4e2a\u5168\u9762\u7684\u53ef\u89c6\u5316\u89e3\u51b3\u65b9\u6848\u7cfb\u5217\u6765\u589e\u5f3a\u5176\u4ea7\u54c1\u751f\u547d\u5468\u671f\u7ba1\u7406(PLM)\u73af\u5883\u3002\u8be5\u8f6f\u4ef6\u5141\u8bb8\u4f01\u4e1a\u7528\u6237\u5728\u5355\u4e00\u73af\u5883\u4e2d\u8bbf\u95ee\u6587\u6863\u30012D\u56fe\u7eb8\u548c3D\u6a21\u578b\u3002\n\nJT2Go\u548cTeamcenter Visualization\u6587\u4ef6\u89e3\u6790\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u83b7\u53d6\u654f\u611f\u4fe1\u606f\u3002",
"formalWay": "\u5382\u5546\u5df2\u63d0\u4f9b\u6f0f\u6d1e\u4fee\u8865\u65b9\u6848\uff0c\u8bf7\u5173\u6ce8\u5382\u5546\u4e3b\u9875\u53ca\u65f6\u66f4\u65b0\uff1a\r\nhttps://cert-portal.siemens.com/productcert/pdf/ssa-595101.pdf",
"isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
"number": "CNVD-2021-100359",
"openTime": "2021-12-16",
"patchDescription": "JT2Go\u662f\u4e00\u4e2a3D JT\u67e5\u770b\u5de5\u5177\uff0cTeamcenter\u53ef\u89c6\u5316\u8f6f\u4ef6\u4f7f\u4f01\u4e1a\u80fd\u591f\u901a\u8fc7\u4e00\u4e2a\u5168\u9762\u7684\u53ef\u89c6\u5316\u89e3\u51b3\u65b9\u6848\u7cfb\u5217\u6765\u589e\u5f3a\u5176\u4ea7\u54c1\u751f\u547d\u5468\u671f\u7ba1\u7406(PLM)\u73af\u5883\u3002\u8be5\u8f6f\u4ef6\u5141\u8bb8\u4f01\u4e1a\u7528\u6237\u5728\u5355\u4e00\u73af\u5883\u4e2d\u8bbf\u95ee\u6587\u6863\u30012D\u56fe\u7eb8\u548c3D\u6a21\u578b\u3002\r\n\r\nJT2Go\u548cTeamcenter Visualization\u6587\u4ef6\u89e3\u6790\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u83b7\u53d6\u654f\u611f\u4fe1\u606f\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
"patchName": "JT2Go\u548cTeamcenter Visualization\u6587\u4ef6\u89e3\u6790\u6f0f\u6d1e\uff08CNVD-2021-100359\uff09\u7684\u8865\u4e01",
"products": {
"product": "SIEMENS Teamcenter Visualization \u003cV13.2.0.5"
},
"referenceLink": "https://cert-portal.siemens.com/productcert/pdf/ssa-595101.pdf",
"serverity": "\u4f4e",
"submitTime": "2021-12-16",
"title": "JT2Go\u548cTeamcenter Visualization\u6587\u4ef6\u89e3\u6790\u6f0f\u6d1e\uff08CNVD-2021-100359\uff09"
}
GSD-2021-44009
Vulnerability from gsd - Updated: 2023-12-13 01:23Details
A vulnerability has been identified in JT2Go (All versions < V13.2.0.5), Teamcenter Visualization (All versions < V13.2.0.5). The Tiff_Loader.dll is vulnerable to an out of bounds read past the end of an allocated buffer when parsing TIFF files. An attacker could leverage this vulnerability to leak information in the context of the current process.
Aliases
Aliases
{
"GSD": {
"alias": "CVE-2021-44009",
"description": "A vulnerability has been identified in JT2Go (All versions \u003c V13.2.0.5), Teamcenter Visualization (All versions \u003c V13.2.0.5). The Tiff_Loader.dll is vulnerable to an out of bounds read past the end of an allocated buffer when parsing TIFF files. An attacker could leverage this vulnerability to leak information in the context of the current process.",
"id": "GSD-2021-44009"
},
"gsd": {
"metadata": {
"exploitCode": "unknown",
"remediation": "unknown",
"reportConfidence": "confirmed",
"type": "vulnerability"
},
"osvSchema": {
"aliases": [
"CVE-2021-44009"
],
"details": "A vulnerability has been identified in JT2Go (All versions \u003c V13.2.0.5), Teamcenter Visualization (All versions \u003c V13.2.0.5). The Tiff_Loader.dll is vulnerable to an out of bounds read past the end of an allocated buffer when parsing TIFF files. An attacker could leverage this vulnerability to leak information in the context of the current process.",
"id": "GSD-2021-44009",
"modified": "2023-12-13T01:23:20.632589Z",
"schema_version": "1.4.0"
}
},
"namespaces": {
"cve.org": {
"CVE_data_meta": {
"ASSIGNER": "productcert@siemens.com",
"ID": "CVE-2021-44009",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "JT2Go",
"version": {
"version_data": [
{
"version_value": "All versions \u003c V13.2.0.5"
}
]
}
},
{
"product_name": "Teamcenter Visualization",
"version": {
"version_data": [
{
"version_value": "All versions \u003c V13.2.0.5"
}
]
}
}
]
},
"vendor_name": "Siemens"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A vulnerability has been identified in JT2Go (All versions \u003c V13.2.0.5), Teamcenter Visualization (All versions \u003c V13.2.0.5). The Tiff_Loader.dll is vulnerable to an out of bounds read past the end of an allocated buffer when parsing TIFF files. An attacker could leverage this vulnerability to leak information in the context of the current process."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-125: Out-of-bounds Read"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://cert-portal.siemens.com/productcert/pdf/ssa-595101.pdf",
"refsource": "MISC",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-595101.pdf"
}
]
}
},
"nvd.nist.gov": {
"configurations": {
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:siemens:jt2go:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "13.2.0.5",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:siemens:teamcenter_visualization:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "13.2.0.5",
"vulnerable": true
}
],
"operator": "OR"
}
]
},
"cve": {
"CVE_data_meta": {
"ASSIGNER": "productcert@siemens.com",
"ID": "CVE-2021-44009"
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "en",
"value": "A vulnerability has been identified in JT2Go (All versions \u003c V13.2.0.5), Teamcenter Visualization (All versions \u003c V13.2.0.5). The Tiff_Loader.dll is vulnerable to an out of bounds read past the end of an allocated buffer when parsing TIFF files. An attacker could leverage this vulnerability to leak information in the context of the current process."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "en",
"value": "CWE-125"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "N/A",
"refsource": "CONFIRM",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-595101.pdf"
}
]
}
},
"impact": {
"baseMetricV2": {
"acInsufInfo": false,
"cvssV2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"userInteractionRequired": true
},
"baseMetricV3": {
"cvssV3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 3.6
}
},
"lastModifiedDate": "2021-12-15T13:23Z",
"publishedDate": "2021-12-14T12:15Z"
}
}
}
SSA-595101
Vulnerability from csaf_siemens - Published: 2021-12-14 00:00 - Updated: 2021-12-14 00:00Summary
SSA-595101: Multiple File Parsing Vulnerabilities in JT2Go and Teamcenter Visualization before V13.2.0.5
Notes
Summary
Siemens has released version V13.2.0.5 for JT2Go and Teamcenter Visualization to fix multiple vulnerabilities that could be triggered when the products read maliciously crafted files in different file formats (PDF, JT, TIFF, CGM and TIF). If a user is tricked to open a malicious file with any of the affected products, this could lead the application to crash or potentially lead to arbitrary code execution.
Siemens recommends to update to the latest versions and to limit opening of untrusted files from unknown sources in the affected products.
General Recommendations
As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.
Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity
Additional Resources
For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories
Terms of Use
Siemens Security Advisories are subject to the terms and conditions contained in Siemens' underlying license terms or other applicable agreements previously agreed to with Siemens (hereinafter "License Terms"). To the extent applicable to information, software or documentation made available in or through a Siemens Security Advisory, the Terms of Use of Siemens' Global Website (https://www.siemens.com/terms_of_use, hereinafter "Terms of Use"), in particular Sections 8-10 of the Terms of Use, shall apply additionally. In case of conflicts, the License Terms shall prevail over the Terms of Use.
{
"document": {
"acknowledgments": [
{
"organization": "Trend Micro Zero Day Initiative",
"summary": "coordinated disclosure of CVE-2021-44001, CVE-2021-44002, CVE-2021-44017 and CVE-2021-44011 through CVE-2021-44015"
},
{
"organization": "Cybersecurity and Infrastructure Security Agency (CISA)",
"summary": "coordinated disclosure"
},
{
"names": [
"Jin Huang"
],
"organization": "ADLab of Venustech",
"summary": "reporting the vulnerabilities from CVE-2021-44003 through CVE-2021-44010"
}
],
"category": "Siemens Security Advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Disclosure is not limited.",
"tlp": {
"label": "WHITE"
}
},
"notes": [
{
"category": "summary",
"text": "Siemens has released version V13.2.0.5 for JT2Go and Teamcenter Visualization to fix multiple vulnerabilities that could be triggered when the products read maliciously crafted files in different file formats (PDF, JT, TIFF, CGM and TIF). If a user is tricked to open a malicious file with any of the affected products, this could lead the application to crash or potentially lead to arbitrary code execution.\n\nSiemens recommends to update to the latest versions and to limit opening of untrusted files from unknown sources in the affected products.",
"title": "Summary"
},
{
"category": "general",
"text": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\n\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity",
"title": "General Recommendations"
},
{
"category": "general",
"text": "For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories",
"title": "Additional Resources"
},
{
"category": "legal_disclaimer",
"text": "Siemens Security Advisories are subject to the terms and conditions contained in Siemens\u0027 underlying license terms or other applicable agreements previously agreed to with Siemens (hereinafter \"License Terms\"). To the extent applicable to information, software or documentation made available in or through a Siemens Security Advisory, the Terms of Use of Siemens\u0027 Global Website (https://www.siemens.com/terms_of_use, hereinafter \"Terms of Use\"), in particular Sections 8-10 of the Terms of Use, shall apply additionally. In case of conflicts, the License Terms shall prevail over the Terms of Use.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "productcert@siemens.com",
"name": "Siemens ProductCERT",
"namespace": "https://www.siemens.com"
},
"references": [
{
"category": "self",
"summary": "SSA-595101: Multiple File Parsing Vulnerabilities in JT2Go and Teamcenter Visualization before V13.2.0.5 - PDF Version",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-595101.pdf"
},
{
"category": "self",
"summary": "SSA-595101: Multiple File Parsing Vulnerabilities in JT2Go and Teamcenter Visualization before V13.2.0.5 - TXT Version",
"url": "https://cert-portal.siemens.com/productcert/txt/ssa-595101.txt"
},
{
"category": "self",
"summary": "SSA-595101: Multiple File Parsing Vulnerabilities in JT2Go and Teamcenter Visualization before V13.2.0.5 - CSAF Version",
"url": "https://cert-portal.siemens.com/productcert/csaf/ssa-595101.json"
}
],
"title": "SSA-595101: Multiple File Parsing Vulnerabilities in JT2Go and Teamcenter Visualization before V13.2.0.5",
"tracking": {
"current_release_date": "2021-12-14T00:00:00Z",
"generator": {
"engine": {
"name": "Siemens ProductCERT CSAF Generator",
"version": "1"
}
},
"id": "SSA-595101",
"initial_release_date": "2021-12-14T00:00:00Z",
"revision_history": [
{
"date": "2021-12-14T00:00:00Z",
"legacy_version": "1.0",
"number": "1",
"summary": "Publication Date"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c V13.2.0.5",
"product": {
"name": "JT2Go",
"product_id": "1"
}
}
],
"category": "product_name",
"name": "JT2Go"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c V13.2.0.5",
"product": {
"name": "Teamcenter Visualization",
"product_id": "2"
}
}
],
"category": "product_name",
"name": "Teamcenter Visualization"
}
],
"category": "vendor",
"name": "Siemens"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2021-44001",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "summary",
"text": "The DL180pdfl.dll contains an out of bounds write past the end of an allocated structure while parsing specially crafted PDF files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-14974)",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1",
"2"
]
},
"references": [
{
"summary": "CVE-2021-44001 - JT2Go",
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"summary": "CVE-2021-44001 - Teamcenter Visualization",
"url": "https://support.sw.siemens.com/"
},
{
"summary": "CVE-2021-44001 Mitre 5.0 json",
"url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2021-44001.json"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V13.2.0.5 or later version",
"product_ids": [
"1"
],
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"category": "vendor_fix",
"details": "Update to V13.2.0.5 or later version",
"product_ids": [
"2"
],
"url": "https://support.sw.siemens.com/"
},
{
"category": "mitigation",
"details": "Avoid to open untrusted files from unknown sources in JT2Go and Teamcenter Visualization",
"product_ids": [
"1",
"2"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1",
"2"
]
}
],
"title": "CVE-2021-44001"
},
{
"cve": "CVE-2021-44002",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "summary",
"text": "The Jt1001.dll contains an out of bounds write past the end of an allocated structure while parsing specially crafted JT files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-15058)",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1",
"2"
]
},
"references": [
{
"summary": "CVE-2021-44002 - JT2Go",
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"summary": "CVE-2021-44002 - Teamcenter Visualization",
"url": "https://support.sw.siemens.com/"
},
{
"summary": "CVE-2021-44002 Mitre 5.0 json",
"url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2021-44002.json"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V13.2.0.5 or later version",
"product_ids": [
"1"
],
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"category": "vendor_fix",
"details": "Update to V13.2.0.5 or later version",
"product_ids": [
"2"
],
"url": "https://support.sw.siemens.com/"
},
{
"category": "mitigation",
"details": "Avoid to open untrusted files from unknown sources in JT2Go and Teamcenter Visualization",
"product_ids": [
"1",
"2"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1",
"2"
]
}
],
"title": "CVE-2021-44002"
},
{
"cve": "CVE-2021-44003",
"cwe": {
"id": "CWE-457",
"name": "Use of Uninitialized Variable"
},
"notes": [
{
"category": "summary",
"text": "The Tiff_Loader.dll is vulnerable to use of uninitialized memory while parsing user supplied TIFF files. This could allow an attacker to cause a denial-of-service condition.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1",
"2"
]
},
"references": [
{
"summary": "CVE-2021-44003 - JT2Go",
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"summary": "CVE-2021-44003 - Teamcenter Visualization",
"url": "https://support.sw.siemens.com/"
},
{
"summary": "CVE-2021-44003 Mitre 5.0 json",
"url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2021-44003.json"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V13.2.0.5 or later version",
"product_ids": [
"1"
],
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"category": "vendor_fix",
"details": "Update to V13.2.0.5 or later version",
"product_ids": [
"2"
],
"url": "https://support.sw.siemens.com/"
},
{
"category": "mitigation",
"details": "Avoid to open untrusted files from unknown sources in JT2Go and Teamcenter Visualization",
"product_ids": [
"1",
"2"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1",
"2"
]
}
],
"title": "CVE-2021-44003"
},
{
"cve": "CVE-2021-44004",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"notes": [
{
"category": "summary",
"text": "The Tiff_Loader.dll is vulnerable to an out of bounds read past the end of an allocated buffer when parsing TIFF files. An attacker could leverage this vulnerability to leak information in the context of the current process.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1",
"2"
]
},
"references": [
{
"summary": "CVE-2021-44004 - JT2Go",
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"summary": "CVE-2021-44004 - Teamcenter Visualization",
"url": "https://support.sw.siemens.com/"
},
{
"summary": "CVE-2021-44004 Mitre 5.0 json",
"url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2021-44004.json"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V13.2.0.5 or later version",
"product_ids": [
"1"
],
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"category": "vendor_fix",
"details": "Update to V13.2.0.5 or later version",
"product_ids": [
"2"
],
"url": "https://support.sw.siemens.com/"
},
{
"category": "mitigation",
"details": "Avoid to open untrusted files from unknown sources in JT2Go and Teamcenter Visualization",
"product_ids": [
"1",
"2"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1",
"2"
]
}
],
"title": "CVE-2021-44004"
},
{
"cve": "CVE-2021-44005",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "summary",
"text": "The Tiff_Loader.dll contains an out of bounds write past the end of an allocated structure while parsing specially crafted TIFF files. This could allow an attacker to execute code in the context of the current process.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1",
"2"
]
},
"references": [
{
"summary": "CVE-2021-44005 - JT2Go",
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"summary": "CVE-2021-44005 - Teamcenter Visualization",
"url": "https://support.sw.siemens.com/"
},
{
"summary": "CVE-2021-44005 Mitre 5.0 json",
"url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2021-44005.json"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V13.2.0.5 or later version",
"product_ids": [
"1"
],
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"category": "vendor_fix",
"details": "Update to V13.2.0.5 or later version",
"product_ids": [
"2"
],
"url": "https://support.sw.siemens.com/"
},
{
"category": "mitigation",
"details": "Avoid to open untrusted files from unknown sources in JT2Go and Teamcenter Visualization",
"product_ids": [
"1",
"2"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1",
"2"
]
}
],
"title": "CVE-2021-44005"
},
{
"cve": "CVE-2021-44006",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "summary",
"text": "The Tiff_Loader.dll contains an out of bounds write past the end of an allocated structure while parsing specially crafted TIFF files. This could allow an attacker to execute code in the context of the current process.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1",
"2"
]
},
"references": [
{
"summary": "CVE-2021-44006 - JT2Go",
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"summary": "CVE-2021-44006 - Teamcenter Visualization",
"url": "https://support.sw.siemens.com/"
},
{
"summary": "CVE-2021-44006 Mitre 5.0 json",
"url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2021-44006.json"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V13.2.0.5 or later version",
"product_ids": [
"1"
],
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"category": "vendor_fix",
"details": "Update to V13.2.0.5 or later version",
"product_ids": [
"2"
],
"url": "https://support.sw.siemens.com/"
},
{
"category": "mitigation",
"details": "Avoid to open untrusted files from unknown sources in JT2Go and Teamcenter Visualization",
"product_ids": [
"1",
"2"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1",
"2"
]
}
],
"title": "CVE-2021-44006"
},
{
"cve": "CVE-2021-44007",
"cwe": {
"id": "CWE-193",
"name": "Off-by-one Error"
},
"notes": [
{
"category": "summary",
"text": "The Tiff_Loader.dll contains an off-by-one error in the heap while parsing specially crafted TIFF files. This could allow an attacker to cause a denial-of-service condition.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1",
"2"
]
},
"references": [
{
"summary": "CVE-2021-44007 - JT2Go",
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"summary": "CVE-2021-44007 - Teamcenter Visualization",
"url": "https://support.sw.siemens.com/"
},
{
"summary": "CVE-2021-44007 Mitre 5.0 json",
"url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2021-44007.json"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V13.2.0.5 or later version",
"product_ids": [
"1"
],
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"category": "vendor_fix",
"details": "Update to V13.2.0.5 or later version",
"product_ids": [
"2"
],
"url": "https://support.sw.siemens.com/"
},
{
"category": "mitigation",
"details": "Avoid to open untrusted files from unknown sources in JT2Go and Teamcenter Visualization",
"product_ids": [
"1",
"2"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1",
"2"
]
}
],
"title": "CVE-2021-44007"
},
{
"cve": "CVE-2021-44008",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"notes": [
{
"category": "summary",
"text": "The Tiff_Loader.dll is vulnerable to an out of bounds read past the end of an allocated buffer when parsing TIFF files. An attacker could leverage this vulnerability to leak information in the context of the current process.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1",
"2"
]
},
"references": [
{
"summary": "CVE-2021-44008 - JT2Go",
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"summary": "CVE-2021-44008 - Teamcenter Visualization",
"url": "https://support.sw.siemens.com/"
},
{
"summary": "CVE-2021-44008 Mitre 5.0 json",
"url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2021-44008.json"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V13.2.0.5 or later version",
"product_ids": [
"1"
],
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"category": "vendor_fix",
"details": "Update to V13.2.0.5 or later version",
"product_ids": [
"2"
],
"url": "https://support.sw.siemens.com/"
},
{
"category": "mitigation",
"details": "Avoid to open untrusted files from unknown sources in JT2Go and Teamcenter Visualization",
"product_ids": [
"1",
"2"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1",
"2"
]
}
],
"title": "CVE-2021-44008"
},
{
"cve": "CVE-2021-44009",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"notes": [
{
"category": "summary",
"text": "The Tiff_Loader.dll is vulnerable to an out of bounds read past the end of an allocated buffer when parsing TIFF files. An attacker could leverage this vulnerability to leak information in the context of the current process.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1",
"2"
]
},
"references": [
{
"summary": "CVE-2021-44009 - JT2Go",
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"summary": "CVE-2021-44009 - Teamcenter Visualization",
"url": "https://support.sw.siemens.com/"
},
{
"summary": "CVE-2021-44009 Mitre 5.0 json",
"url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2021-44009.json"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V13.2.0.5 or later version",
"product_ids": [
"1"
],
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"category": "vendor_fix",
"details": "Update to V13.2.0.5 or later version",
"product_ids": [
"2"
],
"url": "https://support.sw.siemens.com/"
},
{
"category": "mitigation",
"details": "Avoid to open untrusted files from unknown sources in JT2Go and Teamcenter Visualization",
"product_ids": [
"1",
"2"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1",
"2"
]
}
],
"title": "CVE-2021-44009"
},
{
"cve": "CVE-2021-44010",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"notes": [
{
"category": "summary",
"text": "The Tiff_Loader.dll is vulnerable to an out of bounds read past the end of an allocated buffer when parsing TIFF files. An attacker could leverage this vulnerability to leak information in the context of the current process.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1",
"2"
]
},
"references": [
{
"summary": "CVE-2021-44010 - JT2Go",
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"summary": "CVE-2021-44010 - Teamcenter Visualization",
"url": "https://support.sw.siemens.com/"
},
{
"summary": "CVE-2021-44010 Mitre 5.0 json",
"url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2021-44010.json"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V13.2.0.5 or later version",
"product_ids": [
"1"
],
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"category": "vendor_fix",
"details": "Update to V13.2.0.5 or later version",
"product_ids": [
"2"
],
"url": "https://support.sw.siemens.com/"
},
{
"category": "mitigation",
"details": "Avoid to open untrusted files from unknown sources in JT2Go and Teamcenter Visualization",
"product_ids": [
"1",
"2"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1",
"2"
]
}
],
"title": "CVE-2021-44010"
},
{
"cve": "CVE-2021-44011",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"notes": [
{
"category": "summary",
"text": "The Jt1001.dll is vulnerable to an out of bounds read past the end of an allocated buffer while parsing specially crafted JT files. An attacker could leverage this vulnerability to leak information in the context of the current process. (ZDI-CAN-15101)",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1",
"2"
]
},
"references": [
{
"summary": "CVE-2021-44011 - JT2Go",
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"summary": "CVE-2021-44011 - Teamcenter Visualization",
"url": "https://support.sw.siemens.com/"
},
{
"summary": "CVE-2021-44011 Mitre 5.0 json",
"url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2021-44011.json"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V13.2.0.5 or later version",
"product_ids": [
"1"
],
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"category": "vendor_fix",
"details": "Update to V13.2.0.5 or later version",
"product_ids": [
"2"
],
"url": "https://support.sw.siemens.com/"
},
{
"category": "mitigation",
"details": "Avoid to open untrusted files from unknown sources in JT2Go and Teamcenter Visualization",
"product_ids": [
"1",
"2"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1",
"2"
]
}
],
"title": "CVE-2021-44011"
},
{
"cve": "CVE-2021-44012",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"notes": [
{
"category": "summary",
"text": "The Jt1001.dll is vulnerable to an out of bounds read past the end of an allocated buffer when parsing specially crafted JT files. An attacker could leverage this vulnerability to leak information in the context of the current process. (ZDI-CAN-15102)",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1",
"2"
]
},
"references": [
{
"summary": "CVE-2021-44012 - JT2Go",
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"summary": "CVE-2021-44012 - Teamcenter Visualization",
"url": "https://support.sw.siemens.com/"
},
{
"summary": "CVE-2021-44012 Mitre 5.0 json",
"url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2021-44012.json"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V13.2.0.5 or later version",
"product_ids": [
"1"
],
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"category": "vendor_fix",
"details": "Update to V13.2.0.5 or later version",
"product_ids": [
"2"
],
"url": "https://support.sw.siemens.com/"
},
{
"category": "mitigation",
"details": "Avoid to open untrusted files from unknown sources in JT2Go and Teamcenter Visualization",
"product_ids": [
"1",
"2"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1",
"2"
]
}
],
"title": "CVE-2021-44012"
},
{
"cve": "CVE-2021-44013",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "summary",
"text": "The DL180pdfl.dll contains an out of bounds write past the end of an allocated structure while parsing specially crafted JT files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-15103)",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1",
"2"
]
},
"references": [
{
"summary": "CVE-2021-44013 - JT2Go",
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"summary": "CVE-2021-44013 - Teamcenter Visualization",
"url": "https://support.sw.siemens.com/"
},
{
"summary": "CVE-2021-44013 Mitre 5.0 json",
"url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2021-44013.json"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V13.2.0.5 or later version",
"product_ids": [
"1"
],
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"category": "vendor_fix",
"details": "Update to V13.2.0.5 or later version",
"product_ids": [
"2"
],
"url": "https://support.sw.siemens.com/"
},
{
"category": "mitigation",
"details": "Avoid to open untrusted files from unknown sources in JT2Go and Teamcenter Visualization",
"product_ids": [
"1",
"2"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1",
"2"
]
}
],
"title": "CVE-2021-44013"
},
{
"cve": "CVE-2021-44014",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "summary",
"text": "The Jt1001.dll contains a use-after-free vulnerability that could be triggered while parsing specially crafted JT files. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-15057)",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1",
"2"
]
},
"references": [
{
"summary": "CVE-2021-44014 - JT2Go",
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"summary": "CVE-2021-44014 - Teamcenter Visualization",
"url": "https://support.sw.siemens.com/"
},
{
"summary": "CVE-2021-44014 Mitre 5.0 json",
"url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2021-44014.json"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V13.2.0.5 or later version",
"product_ids": [
"1"
],
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"category": "vendor_fix",
"details": "Update to V13.2.0.5 or later version",
"product_ids": [
"2"
],
"url": "https://support.sw.siemens.com/"
},
{
"category": "mitigation",
"details": "Avoid to open untrusted files from unknown sources in JT2Go and Teamcenter Visualization",
"product_ids": [
"1",
"2"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1",
"2"
]
}
],
"title": "CVE-2021-44014"
},
{
"cve": "CVE-2021-44015",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"notes": [
{
"category": "summary",
"text": "The VCRUNTIME140.dll is vulnerable to an out of bounds read past the end of an allocated buffer when parsing specially crafted CGM files. An attacker could leverage this vulnerability to leak information in the context of the current process. (ZDI-CAN-15109)",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1",
"2"
]
},
"references": [
{
"summary": "CVE-2021-44015 - JT2Go",
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"summary": "CVE-2021-44015 - Teamcenter Visualization",
"url": "https://support.sw.siemens.com/"
},
{
"summary": "CVE-2021-44015 Mitre 5.0 json",
"url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2021-44015.json"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V13.2.0.5 or later version",
"product_ids": [
"1"
],
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"category": "vendor_fix",
"details": "Update to V13.2.0.5 or later version",
"product_ids": [
"2"
],
"url": "https://support.sw.siemens.com/"
},
{
"category": "mitigation",
"details": "Avoid to open untrusted files from unknown sources in JT2Go and Teamcenter Visualization",
"product_ids": [
"1",
"2"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1",
"2"
]
}
],
"title": "CVE-2021-44015"
},
{
"cve": "CVE-2021-44017",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"notes": [
{
"category": "summary",
"text": "The Image.dll is vulnerable to an out of bounds read past the end of an allocated buffer when parsing specially crafted TIF files. An attacker could leverage this vulnerability to leak information in the context of the current process. (ZDI-CAN-15111)",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1",
"2"
]
},
"references": [
{
"summary": "CVE-2021-44017 - JT2Go",
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"summary": "CVE-2021-44017 - Teamcenter Visualization",
"url": "https://support.sw.siemens.com/"
},
{
"summary": "CVE-2021-44017 Mitre 5.0 json",
"url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2021-44017.json"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V13.2.0.5 or later version",
"product_ids": [
"1"
],
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"category": "vendor_fix",
"details": "Update to V13.2.0.5 or later version",
"product_ids": [
"2"
],
"url": "https://support.sw.siemens.com/"
},
{
"category": "mitigation",
"details": "Avoid to open untrusted files from unknown sources in JT2Go and Teamcenter Visualization",
"product_ids": [
"1",
"2"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1",
"2"
]
}
],
"title": "CVE-2021-44017"
}
]
}
GHSA-RCRG-GRJR-GMC3
Vulnerability from github – Published: 2021-12-15 00:01 – Updated: 2021-12-16 00:02
VLAI?
Details
A vulnerability has been identified in JT2Go (All versions < V13.2.0.5), Teamcenter Visualization (All versions < V13.2.0.5). The Tiff_Loader.dll is vulnerable to an out of bounds read past the end of an allocated buffer when parsing TIFF files. An attacker could leverage this vulnerability to leak information in the context of the current process.
{
"affected": [],
"aliases": [
"CVE-2021-44009"
],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-12-14T12:15:00Z",
"severity": "MODERATE"
},
"details": "A vulnerability has been identified in JT2Go (All versions \u003c V13.2.0.5), Teamcenter Visualization (All versions \u003c V13.2.0.5). The Tiff_Loader.dll is vulnerable to an out of bounds read past the end of an allocated buffer when parsing TIFF files. An attacker could leverage this vulnerability to leak information in the context of the current process.",
"id": "GHSA-rcrg-grjr-gmc3",
"modified": "2021-12-16T00:02:32Z",
"published": "2021-12-15T00:01:20Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44009"
},
{
"type": "WEB",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-595101.pdf"
}
],
"schema_version": "1.4.0",
"severity": []
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…