Details of VAR-202102-0319

ID

VAR-202102-0319

CVE

CVE-2020-26998

TITLE

JT2Go and Teamcenter Visualization Out-of-bounds read vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2020-015932

DESCRIPTION

A vulnerability has been identified in JT2Go (All versions < V13.1.0.2), Teamcenter Visualization (All versions < V13.1.0.2). Affected applications lack proper validation of user-supplied data when parsing of PAR files. This could result in a memory access past the end of an allocated buffer. An attacker could leverage this vulnerability to leak information. (ZDI-CAN-12040). JT2Go and Teamcenter Visualization Is vulnerable to an out-of-bounds read. Zero Day Initiative To this vulnerability ZDI-CAN-12040 Was numbered.Information may be obtained. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Siemens JT2Go. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the parsing of PAR files

Trust: 2.97

sources: NVD: CVE-2020-26998 // JVNDB: JVNDB-2020-015932 // ZDI: ZDI-21-238 // ZDI: ZDI-21-857 // VULMON: CVE-2020-26998

AFFECTED PRODUCTS

vendor:	siemens	model:	jt2go	scope:	-	version:	-	Trust: 1.4
vendor:	siemens	model:	jt2go	scope:	lt	version:	13.1.0.2	Trust: 1.0
vendor:	siemens	model:	teamcenter visualization	scope:	lt	version:	13.1.0.2	Trust: 1.0
vendor:	シーメンス	model:	jt2go	scope:	-	version:	-	Trust: 0.8
vendor:	シーメンス	model:	teamcenter visualization	scope:	eq	version:	13.1.0.2	Trust: 0.8

sources: ZDI: ZDI-21-238 // ZDI: ZDI-21-857 // JVNDB: JVNDB-2020-015932 // NVD: CVE-2020-26998

CVSS

SEVERITY

CVSSV2

CVSSV3

NVD:	CVE-2020-26998
value:	MEDIUM
Trust: 1.8
ZDI:	CVE-2020-26998
value:	HIGH
Trust: 1.4
CNNVD:	CNNVD-202102-876
value:	MEDIUM
Trust: 0.6
VULMON:	CVE-2020-26998
value:	LOW
Trust: 0.1

NVD:
severity:	LOW
baseScore:	2.1
vectorString:	AV:L/AC:L/AU:N/C:P/I:N/A:N
accessVector:	LOCAL
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	3.9
impactScore:	2.9
acInsufInfo:	FALSE
obtainAllPrivilege:	FALSE
obtainUserPrivilege:	FALSE
obtainOtherPrivilege:	FALSE
userInteractionRequired:	FALSE
version:	2.0
Trust: 1.0
NVD:	CVE-2020-26998
severity:	LOW
baseScore:	2.1
vectorString:	AV:L/AC:L/AU:N/C:P/I:N/A:N
accessVector:	LOCAL
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	NONE
impactScore:	NONE
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.9

ZDI:	CVE-2020-26998
baseSeverity:	HIGH
baseScore:	7.8
vectorString:	AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector:	LOCAL
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	REQUIRED
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	1.8
impactScore:	5.9
version:	3.0
Trust: 1.4
NVD:
baseSeverity:	MEDIUM
baseScore:	5.5
vectorString:	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
attackVector:	LOCAL
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	1.8
impactScore:	3.6
version:	3.1
Trust: 1.0
NVD:	CVE-2020-26998
baseSeverity:	MEDIUM
baseScore:	5.5
vectorString:	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
attackVector:	LOCAL
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: ZDI: ZDI-21-238 // ZDI: ZDI-21-857 // VULMON: CVE-2020-26998 // JVNDB: JVNDB-2020-015932 // NVD: CVE-2020-26998 // CNNVD: CNNVD-202102-876

PROBLEMTYPE DATA

problemtype:	CWE-125	Trust: 1.0
problemtype:	Out-of-bounds read (CWE-125) [NVD Evaluation ]	Trust: 0.8

sources: JVNDB: JVNDB-2020-015932 // NVD: CVE-2020-26998

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-202102-876

TYPE

buffer error

Trust: 0.6

sources: CNNVD: CNNVD-202102-876

CONFIGURATIONS

sources: NVD: CVE-2020-26998

PATCH

title:	SSA-663999 Siemens Security Advisory	url:	https://cert-portal.siemens.com/productcert/pdf/ssa-663999.pdf	Trust: 0.8
title:	https://us-cert.cisa.gov/ics/advisories/icsa-21-147-04	url:	https://cert-portal.siemens.com/productcert/pdf/ssa-695540.pdf	Trust: 0.7
title:	-	url:	https://us-cert.cisa.gov/ics/advisories/icsa-21-147-04https://cert-portal.siemens.com/productcert/pdf/ssa-695540.pdf	Trust: 0.7
title:	JT2Go Buffer error vulnerability fix	url:	http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=141297	Trust: 0.6
title:	Siemens Security Advisories: Siemens Security Advisory	url:	https://vulmon.com/vendoradvisory?qidtp=siemens_security_advisories&qid=22012358d4c381f4f14edecd2684a63a	Trust: 0.1
title:	Siemens Security Advisories: Siemens Security Advisory	url:	https://vulmon.com/vendoradvisory?qidtp=siemens_security_advisories&qid=1c3bdb36e22f42f5b9339f0ff806382c	Trust: 0.1

sources: ZDI: ZDI-21-238 // ZDI: ZDI-21-857 // VULMON: CVE-2020-26998 // JVNDB: JVNDB-2020-015932 // CNNVD: CNNVD-202102-876

EXTERNAL IDS

db:	NVD	id:	CVE-2020-26998	Trust: 3.9
db:	ZDI	id:	ZDI-21-238	Trust: 3.2
db:	ZDI	id:	ZDI-21-857	Trust: 3.2
db:	SIEMENS	id:	SSA-695540	Trust: 1.7
db:	SIEMENS	id:	SSA-663999	Trust: 1.7
db:	JVNDB	id:	JVNDB-2020-015932	Trust: 0.8
db:	ZDI_CAN	id:	ZDI-CAN-12040	Trust: 0.7
db:	ZDI_CAN	id:	ZDI-CAN-13407	Trust: 0.7
db:	AUSCERT	id:	ESB-2021.1836	Trust: 0.6
db:	AUSCERT	id:	ESB-2021.0495	Trust: 0.6
db:	ICS CERT	id:	ICSA-21-147-04	Trust: 0.6
db:	ICS CERT	id:	ICSA-21-040-06	Trust: 0.6
db:	CNNVD	id:	CNNVD-202102-876	Trust: 0.6
db:	VULMON	id:	CVE-2020-26998	Trust: 0.1

sources: ZDI: ZDI-21-238 // ZDI: ZDI-21-857 // VULMON: CVE-2020-26998 // JVNDB: JVNDB-2020-015932 // NVD: CVE-2020-26998 // CNNVD: CNNVD-202102-876

REFERENCES

url:	https://www.zerodayinitiative.com/advisories/zdi-21-238/	Trust: 2.5
url:	https://www.zerodayinitiative.com/advisories/zdi-21-857/	Trust: 2.5
url:	https://cert-portal.siemens.com/productcert/pdf/ssa-695540.pdf	Trust: 2.4
url:	https://cert-portal.siemens.com/productcert/pdf/ssa-663999.pdf	Trust: 1.7
url:	https://us-cert.cisa.gov/ics/advisories/icsa-21-147-04	Trust: 1.3
url:	https://nvd.nist.gov/vuln/detail/cve-2020-26998	Trust: 0.8
url:	https://us-cert.cisa.gov/ics/advisories/icsa-21-147-04https://cert-portal.siemens.com/productcert/pdf/ssa-695540.pdf	Trust: 0.7
url:	https://us-cert.cisa.gov/ics/advisories/icsa-21-040-06	Trust: 0.6
url:	https://www.auscert.org.au/bulletins/esb-2021.0495	Trust: 0.6
url:	https://www.auscert.org.au/bulletins/esb-2021.1836	Trust: 0.6
url:	https://cwe.mitre.org/data/definitions/125.html	Trust: 0.1
url:	https://nvd.nist.gov	Trust: 0.1

sources: ZDI: ZDI-21-238 // ZDI: ZDI-21-857 // VULMON: CVE-2020-26998 // JVNDB: JVNDB-2020-015932 // NVD: CVE-2020-26998 // CNNVD: CNNVD-202102-876

CREDITS

Mat Powell of Trend Micro Zero Day Initiative

Trust: 1.3

sources: ZDI: ZDI-21-857 // CNNVD: CNNVD-202102-876

SOURCES

db:	ZDI	id:	ZDI-21-238
db:	ZDI	id:	ZDI-21-857
db:	VULMON	id:	CVE-2020-26998
db:	JVNDB	id:	JVNDB-2020-015932
db:	NVD	id:	CVE-2020-26998
db:	CNNVD	id:	CNNVD-202102-876

LAST UPDATE DATE

2023-12-18T11:30:16.566000+00:00

SOURCES UPDATE DATE

db:	ZDI	id:	ZDI-21-238	date:	2021-06-08T00:00:00
db:	ZDI	id:	ZDI-21-857	date:	2021-07-19T00:00:00
db:	VULMON	id:	CVE-2020-26998	date:	2021-07-19T00:00:00
db:	JVNDB	id:	JVNDB-2020-015932	date:	2021-10-25T07:20:00
db:	NVD	id:	CVE-2020-26998	date:	2022-02-22T14:14:58.653
db:	CNNVD	id:	CNNVD-202102-876	date:	2021-07-20T00:00:00

SOURCES RELEASE DATE

db:	ZDI	id:	ZDI-21-238	date:	2021-02-24T00:00:00
db:	ZDI	id:	ZDI-21-857	date:	2021-07-19T00:00:00
db:	VULMON	id:	CVE-2020-26998	date:	2021-02-09T00:00:00
db:	JVNDB	id:	JVNDB-2020-015932	date:	2021-10-25T00:00:00
db:	NVD	id:	CVE-2020-26998	date:	2021-02-09T17:15:13.767
db:	CNNVD	id:	CNNVD-202102-876	date:	2021-02-09T00:00:00