mirror of
https://github.com/CVEProject/cvelist.git
synced 2025-07-29 05:56:59 +00:00
153 lines
9.6 KiB
JSON
153 lines
9.6 KiB
JSON
{
|
|
"data_version": "4.0",
|
|
"data_type": "CVE",
|
|
"data_format": "MITRE",
|
|
"CVE_data_meta": {
|
|
"ID": "CVE-2021-38405",
|
|
"ASSIGNER": "ics-cert@hq.dhs.gov",
|
|
"STATE": "PUBLIC"
|
|
},
|
|
"description": {
|
|
"description_data": [
|
|
{
|
|
"lang": "eng",
|
|
"value": "The Datalogics APDFL library used in affected products is vulnerable to memory corruption condition\u00a0while parsing specially crafted PDF files. An attacker could leverage this vulnerability to execute code\u00a0in the context of the current process."
|
|
}
|
|
]
|
|
},
|
|
"problemtype": {
|
|
"problemtype_data": [
|
|
{
|
|
"description": [
|
|
{
|
|
"lang": "eng",
|
|
"value": "CWE-119",
|
|
"cweId": "CWE-119"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
},
|
|
"affects": {
|
|
"vendor": {
|
|
"vendor_data": [
|
|
{
|
|
"vendor_name": "Siemens",
|
|
"product": {
|
|
"product_data": [
|
|
{
|
|
"product_name": "JT2Go",
|
|
"version": {
|
|
"version_data": [
|
|
{
|
|
"version_affected": "<",
|
|
"version_name": "0",
|
|
"version_value": "13.2.0.7"
|
|
}
|
|
]
|
|
}
|
|
},
|
|
{
|
|
"product_name": "Teamcenter Visualization",
|
|
"version": {
|
|
"version_data": [
|
|
{
|
|
"version_affected": "<",
|
|
"version_name": "12.4",
|
|
"version_value": "12.4.0.13"
|
|
},
|
|
{
|
|
"version_affected": "<",
|
|
"version_name": "13.1",
|
|
"version_value": "13.1.0.8"
|
|
},
|
|
{
|
|
"version_affected": "<",
|
|
"version_name": "13.2",
|
|
"version_value": "13.2.0.7"
|
|
},
|
|
{
|
|
"version_affected": "<",
|
|
"version_name": "13.3",
|
|
"version_value": "13.3.0.1"
|
|
}
|
|
]
|
|
}
|
|
}
|
|
]
|
|
}
|
|
}
|
|
]
|
|
}
|
|
},
|
|
"references": {
|
|
"reference_data": [
|
|
{
|
|
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-301589.pdf",
|
|
"refsource": "MISC",
|
|
"name": "https://cert-portal.siemens.com/productcert/pdf/ssa-301589.pdf"
|
|
},
|
|
{
|
|
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-22-041-07",
|
|
"refsource": "MISC",
|
|
"name": "https://www.cisa.gov/news-events/ics-advisories/icsa-22-041-07"
|
|
}
|
|
]
|
|
},
|
|
"generator": {
|
|
"engine": "Vulnogram 0.2.0"
|
|
},
|
|
"source": {
|
|
"discovery": "EXTERNAL"
|
|
},
|
|
"work_around": [
|
|
{
|
|
"lang": "en",
|
|
"supportingMedia": [
|
|
{
|
|
"base64": false,
|
|
"type": "text/html",
|
|
"value": "\n\n<p>Siemens has identified the following specific workarounds and mitigations users can apply to reduce the risk:</p>\n<ul><li>Avoid opening untrusted files from unknown sources in affected products.</li>\n</ul><p>As a general security measure, Siemens strongly recommends \nprotecting network access to devices with appropriate mechanisms. In \norder to operate the devices in a protected IT environment, Siemens \nrecommends configuring the environment according to <a target=\"_blank\" rel=\"nofollow\" href=\"https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf\">Siemens\u2019 operational guidelines for industrial security</a><span style=\"background-color: var(--wht);\">, and to follow the recommendations in the product manuals.</span></p>\n<p>Additional information on industrial security by Siemens can be found on the <a target=\"_blank\" rel=\"nofollow\" href=\"https://www.siemens.com/industrialsecurity\">Siemens industrial security webpage</a><span style=\"background-color: var(--wht);\">.</span></p>\n<p>Please see Siemens security advisory <a target=\"_blank\" rel=\"nofollow\" href=\"https://cert-portal.siemens.com/productcert/pdf/ssa-301589.pdf\">SSA-301589</a> <span style=\"background-color: var(--wht);\">for more information.</span></p>\n\n<br>"
|
|
}
|
|
],
|
|
"value": "Siemens has identified the following specific workarounds and mitigations users can apply to reduce the risk:\n\n\n * Avoid opening untrusted files from unknown sources in affected products.\n\n\n\nAs a general security measure, Siemens strongly recommends \nprotecting network access to devices with appropriate mechanisms. In \norder to operate the devices in a protected IT environment, Siemens \nrecommends configuring the environment according to Siemens\u2019 operational guidelines for industrial security https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf , and to follow the recommendations in the product manuals.\n\n\nAdditional information on industrial security by Siemens can be found on the Siemens industrial security webpage https://www.siemens.com/industrialsecurity .\n\n\nPlease see Siemens security advisory SSA-301589 https://cert-portal.siemens.com/productcert/pdf/ssa-301589.pdf \u00a0for more information."
|
|
}
|
|
],
|
|
"solution": [
|
|
{
|
|
"lang": "en",
|
|
"supportingMedia": [
|
|
{
|
|
"base64": false,
|
|
"type": "text/html",
|
|
"value": "\n<p>Siemens has released updates for some of the affected products and \nrecommends updating to the latest versions. Siemens is preparing further\n updates and recommends specific countermeasures for products where \nupdates are not yet available.</p>\n<ul><li>JT2Go: <a target=\"_blank\" rel=\"nofollow\" href=\"https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html\">Update to v13.2.0.7</a> or later version</li><li>Teamcenter Visualization v13.1: <a target=\"_blank\" rel=\"nofollow\" href=\"https://support.sw.siemens.com/\">Update to v13.1.0.9 or later version</a></li><li>Teamcenter Visualization v13.2: <a target=\"_blank\" rel=\"nofollow\" href=\"https://support.sw.siemens.com/\">Update to v13.2.0.7 or later version</a></li><li><span style=\"background-color: var(--wht);\">Teamcenter Visualization v13.3: </span><a target=\"_blank\" rel=\"nofollow\" href=\"https://support.sw.siemens.com/\">Update to v13.3.0.1 or later version</a><br></li></ul><p><span style=\"background-color: var(--wht);\">Please see Siemens security advisory </span><a target=\"_blank\" rel=\"nofollow\" href=\"https://cert-portal.siemens.com/productcert/pdf/ssa-301589.pdf\">SSA-301589</a><span style=\"background-color: var(--wht);\"> </span><span style=\"background-color: var(--wht);\">for more information.</span><br></p>"
|
|
}
|
|
],
|
|
"value": "Siemens has released updates for some of the affected products and \nrecommends updating to the latest versions. Siemens is preparing further\n updates and recommends specific countermeasures for products where \nupdates are not yet available.\n\n\n * JT2Go: Update to v13.2.0.7 https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html \u00a0or later version\n * Teamcenter Visualization v13.1: Update to v13.1.0.9 or later version https://support.sw.siemens.com/ \n * Teamcenter Visualization v13.2: Update to v13.2.0.7 or later version https://support.sw.siemens.com/ \n * Teamcenter Visualization v13.3: Update to v13.3.0.1 or later version https://support.sw.siemens.com/ \n\n\n\nPlease see Siemens security advisory SSA-301589 https://cert-portal.siemens.com/productcert/pdf/ssa-301589.pdf \u00a0for more information."
|
|
}
|
|
],
|
|
"credits": [
|
|
{
|
|
"lang": "en",
|
|
"value": "Mat Powell of Trend Micro\u2019s Zero Day Initiative reported these vulnerabilities to Siemens and CISA."
|
|
}
|
|
],
|
|
"impact": {
|
|
"cvss": [
|
|
{
|
|
"attackComplexity": "LOW",
|
|
"attackVector": "LOCAL",
|
|
"availabilityImpact": "HIGH",
|
|
"baseScore": 7.8,
|
|
"baseSeverity": "HIGH",
|
|
"confidentialityImpact": "HIGH",
|
|
"integrityImpact": "HIGH",
|
|
"privilegesRequired": "NONE",
|
|
"scope": "UNCHANGED",
|
|
"userInteraction": "REQUIRED",
|
|
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
|
|
"version": "3.1"
|
|
}
|
|
]
|
|
}
|
|
} |