Sign-up

ID

VAR-202102-0323


CVE

CVE-2020-27002


TITLE

JT2Go  and  Teamcenter Visualization  Out-of-bounds read vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2020-015925

DESCRIPTION

A vulnerability has been identified in JT2Go (All versions < V13.1.0.2), Teamcenter Visualization (All versions < V13.1.0.2). Affected applications lack proper validation of user-supplied data when parsing of PAR files. This could result in a memory access past the end of an allocated buffer. An attacker could leverage this vulnerability to access data in the context of the current process. (ZDI-CAN-12043). JT2Go and Teamcenter Visualization Is vulnerable to an out-of-bounds read. Zero Day Initiative To this vulnerability ZDI-CAN-12043 Was numbered.Information may be obtained and information may be tampered with. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Siemens JT2Go. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the parsing of PAR files

Trust: 2.34

sources: NVD: CVE-2020-27002 // JVNDB: JVNDB-2020-015925 // ZDI: ZDI-21-228 // VULMON: CVE-2020-27002

AFFECTED PRODUCTS

vendor:siemensmodel:jt2goscope:ltversion:13.1.0.2

Trust: 1.0

vendor:siemensmodel:teamcenter visualizationscope:ltversion:13.1.0.2

Trust: 1.0

vendor:シーメンスmodel:jt2goscope: - version: -

Trust: 0.8

vendor:シーメンスmodel:teamcenter visualizationscope:eqversion:13.1.0.2

Trust: 0.8

vendor:siemensmodel:jt2goscope: - version: -

Trust: 0.7

sources: ZDI: ZDI-21-228 // JVNDB: JVNDB-2020-015925 // NVD: CVE-2020-27002

CVSS

SEVERITY

CVSSV2

CVSSV3

NVD: CVE-2020-27002
value: HIGH

Trust: 1.8

ZDI: CVE-2020-27002
value: LOW

Trust: 0.7

CNNVD: CNNVD-202102-872
value: HIGH

Trust: 0.6

VULMON: CVE-2020-27002
value: LOW

Trust: 0.1

NVD:
severity: LOW
baseScore: 3.6
vectorString: AV:L/AC:L/AU:N/C:P/I:P/A:N
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 3.9
impactScore: 4.9
acInsufInfo: FALSE
obtainAllPrivilege: FALSE
obtainUserPrivilege: FALSE
obtainOtherPrivilege: FALSE
userInteractionRequired: FALSE
version: 2.0

Trust: 1.0

NVD: CVE-2020-27002
severity: LOW
baseScore: 3.6
vectorString: AV:L/AC:L/AU:N/C:P/I:P/A:N
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: NONE
impactScore: NONE
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.9

NVD:
baseSeverity: HIGH
baseScore: 7.1
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: NONE
exploitabilityScore: 1.8
impactScore: 5.2
version: 3.1

Trust: 1.0

NVD: CVE-2020-27002
baseSeverity: HIGH
baseScore: 7.1
vectorString: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: NONE
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

ZDI: CVE-2020-27002
baseSeverity: LOW
baseScore: 3.3
vectorString: AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 1.8
impactScore: 1.4
version: 3.0

Trust: 0.7

sources: ZDI: ZDI-21-228 // VULMON: CVE-2020-27002 // JVNDB: JVNDB-2020-015925 // NVD: CVE-2020-27002 // CNNVD: CNNVD-202102-872

PROBLEMTYPE DATA

problemtype:CWE-125

Trust: 1.0

problemtype:Out-of-bounds read (CWE-125) [NVD Evaluation ]

Trust: 0.8

sources: JVNDB: JVNDB-2020-015925 // NVD: CVE-2020-27002

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-202102-872

TYPE

buffer error

Trust: 0.6

sources: CNNVD: CNNVD-202102-872

CONFIGURATIONS

sources:
            
            
            NVD: CVE-2020-27002

PATCH
title:SSA-663999 Siemens Security Advisoryurl:https://cert-portal.siemens.com/productcert/pdf/ssa-663999.pdf
Trust: 0.8
title: https://us-cert.cisa.gov/ics/advisories/icsa-21-147-04url:https://cert-portal.siemens.com/productcert/pdf/ssa-695540.pdf
Trust: 0.7
title:JT2Go Buffer error vulnerability fixurl:http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=141293
Trust: 0.6
title:Siemens Security Advisories: Siemens Security Advisoryurl:https://vulmon.com/vendoradvisory?qidtp=siemens_security_advisories&qid=22012358d4c381f4f14edecd2684a63a
Trust: 0.1
title:Siemens Security Advisories: Siemens Security Advisoryurl:https://vulmon.com/vendoradvisory?qidtp=siemens_security_advisories&qid=1c3bdb36e22f42f5b9339f0ff806382c
Trust: 0.1
sources:
            
            
            ZDI: ZDI-21-228 // 
            
            
            
            VULMON: CVE-2020-27002 // 
            
            
            
            JVNDB: JVNDB-2020-015925 // 
            
            
            
            CNNVD: CNNVD-202102-872

EXTERNAL IDS
db:NVDid:CVE-2020-27002
Trust: 3.2
db:ZDIid:ZDI-21-228
Trust: 3.2
db:SIEMENSid:SSA-695540
Trust: 1.7
db:SIEMENSid:SSA-663999
Trust: 1.7
db:JVNDBid:JVNDB-2020-015925
Trust: 0.8
db:ZDI_CANid:ZDI-CAN-12043
Trust: 0.7
db:ICS CERTid:ICSA-21-040-06
Trust: 0.6
db:ICS CERTid:ICSA-21-147-04
Trust: 0.6
db:AUSCERTid:ESB-2021.0495
Trust: 0.6
db:AUSCERTid:ESB-2021.1836
Trust: 0.6
db:CNNVDid:CNNVD-202102-872
Trust: 0.6
db:VULMONid:CVE-2020-27002
Trust: 0.1
sources:
            
            
            ZDI: ZDI-21-228 // 
            
            
            
            VULMON: CVE-2020-27002 // 
            
            
            
            JVNDB: JVNDB-2020-015925 // 
            
            
            
            NVD: CVE-2020-27002 // 
            
            
            
            CNNVD: CNNVD-202102-872

REFERENCES
url:https://www.zerodayinitiative.com/advisories/zdi-21-228/
Trust: 2.6
url:https://cert-portal.siemens.com/productcert/pdf/ssa-695540.pdf
Trust: 2.4
url:https://cert-portal.siemens.com/productcert/pdf/ssa-663999.pdf
Trust: 1.7
url:https://us-cert.cisa.gov/ics/advisories/icsa-21-147-04
Trust: 1.3
url:https://nvd.nist.gov/vuln/detail/cve-2020-27002
Trust: 0.8
url:https://us-cert.cisa.gov/ics/advisories/icsa-21-040-06
Trust: 0.6
url:https://www.auscert.org.au/bulletins/esb-2021.0495
Trust: 0.6
url:https://www.auscert.org.au/bulletins/esb-2021.1836
Trust: 0.6
url:https://cwe.mitre.org/data/definitions/125.html
Trust: 0.1
url:https://nvd.nist.gov
Trust: 0.1
sources:
            
            
            ZDI: ZDI-21-228 // 
            
            
            
            VULMON: CVE-2020-27002 // 
            
            
            
            JVNDB: JVNDB-2020-015925 // 
            
            
            
            NVD: CVE-2020-27002 // 
            
            
            
            CNNVD: CNNVD-202102-872

CREDITS
rgod
Trust: 0.7
sources:
            
            
            ZDI: ZDI-21-228

SOURCES
db:ZDIid:ZDI-21-228
db:VULMONid:CVE-2020-27002
db:JVNDBid:JVNDB-2020-015925
db:NVDid:CVE-2020-27002
db:CNNVDid:CNNVD-202102-872

LAST UPDATE DATE
2023-12-18T11:03:34.471000+00:00

SOURCES UPDATE DATE
db:ZDIid:ZDI-21-228date:2021-06-08T00:00:00
db:VULMONid:CVE-2020-27002date:2021-05-19T00:00:00
db:JVNDBid:JVNDB-2020-015925date:2021-10-25T06:42:00
db:NVDid:CVE-2020-27002date:2022-04-29T19:04:11.183
db:CNNVDid:CNNVD-202102-872date:2021-05-28T00:00:00

SOURCES RELEASE DATE
db:ZDIid:ZDI-21-228date:2021-02-24T00:00:00
db:VULMONid:CVE-2020-27002date:2021-02-09T00:00:00
db:JVNDBid:JVNDB-2020-015925date:2021-10-25T00:00:00
db:NVDid:CVE-2020-27002date:2021-02-09T17:15:14.077
db:CNNVDid:CNNVD-202102-872date:2021-02-09T00:00:00