Sign-up

ID

VAR-202102-0325


CVE

CVE-2020-27004


TITLE

JT2Go  and  Teamcenter Visualization  Out-of-bounds read vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2020-015923

DESCRIPTION

A vulnerability has been identified in JT2Go (All versions < V13.1.0.1), Teamcenter Visualization (All versions < V13.1.0.1). Affected applications lack proper validation of user-supplied data when parsing of CGM files. This could result in a memory access past the end of an allocated buffer. An attacker could leverage this vulnerability to access data in the context of the current process. (ZDI-CAN-12163). JT2Go and Teamcenter Visualization Is vulnerable to an out-of-bounds read. Zero Day Initiative To this vulnerability ZDI-CAN-12163 Was numbered.Information may be obtained. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Siemens JT2Go. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the parsing of CGM files

Trust: 2.25

sources: NVD: CVE-2020-27004 // JVNDB: JVNDB-2020-015923 // ZDI: ZDI-21-230

AFFECTED PRODUCTS

vendor:siemensmodel:teamcenter visualizationscope:ltversion:13.1.0.1

Trust: 1.0

vendor:siemensmodel:jt2goscope:ltversion:13.1.0.1

Trust: 1.0

vendor:シーメンスmodel:jt2goscope: - version: -

Trust: 0.8

vendor:シーメンスmodel:teamcenter visualizationscope:eqversion:13.1.0.1

Trust: 0.8

vendor:siemensmodel:jt2goscope: - version: -

Trust: 0.7

sources: ZDI: ZDI-21-230 // JVNDB: JVNDB-2020-015923 // NVD: CVE-2020-27004

CVSS

SEVERITY

CVSSV2

CVSSV3

NVD: CVE-2020-27004
value: MEDIUM

Trust: 1.8

ZDI: CVE-2020-27004
value: LOW

Trust: 0.7

CNNVD: CNNVD-202102-869
value: MEDIUM

Trust: 0.6

NVD:
severity: MEDIUM
baseScore: 4.3
vectorString: AV:N/AC:M/AU:N/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 8.6
impactScore: 2.9
acInsufInfo: FALSE
obtainAllPrivilege: FALSE
obtainUserPrivilege: FALSE
obtainOtherPrivilege: FALSE
userInteractionRequired: TRUE
version: 2.0

Trust: 1.0

NVD: CVE-2020-27004
severity: MEDIUM
baseScore: 4.3
vectorString: AV:N/AC:M/AU:N/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: NONE
impactScore: NONE
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.8

NVD:
baseSeverity: MEDIUM
baseScore: 5.5
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 1.8
impactScore: 3.6
version: 3.1

Trust: 1.0

NVD: CVE-2020-27004
baseSeverity: MEDIUM
baseScore: 5.5
vectorString: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

ZDI: CVE-2020-27004
baseSeverity: LOW
baseScore: 2.5
vectorString: AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
attackVector: LOCAL
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 1.0
impactScore: 1.4
version: 3.0

Trust: 0.7

sources: ZDI: ZDI-21-230 // JVNDB: JVNDB-2020-015923 // NVD: CVE-2020-27004 // CNNVD: CNNVD-202102-869

PROBLEMTYPE DATA

problemtype:CWE-125

Trust: 1.0

problemtype:Out-of-bounds read (CWE-125) [NVD Evaluation ]

Trust: 0.8

sources: JVNDB: JVNDB-2020-015923 // NVD: CVE-2020-27004

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-202102-869

TYPE

buffer error

Trust: 0.6

sources: CNNVD: CNNVD-202102-869

CONFIGURATIONS

sources:
            
            
            NVD: CVE-2020-27004

PATCH
title:SSA-663999url:https://cert-portal.siemens.com/productcert/pdf/ssa-663999.pdf
Trust: 0.8
title:Siemens has issued an update to correct this vulnerability.url:https://us-cert.cisa.gov/ics/advisories/icsa-21-040-06
Trust: 0.7
title:JT2Go Buffer error vulnerability fixurl:http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=141291
Trust: 0.6
sources:
            
            
            ZDI: ZDI-21-230 // 
            
            
            
            JVNDB: JVNDB-2020-015923 // 
            
            
            
            CNNVD: CNNVD-202102-869

EXTERNAL IDS
db:NVDid:CVE-2020-27004
Trust: 3.1
db:ZDIid:ZDI-21-230
Trust: 3.1
db:SIEMENSid:SSA-663999
Trust: 1.6
db:JVNid:JVNVU91083521
Trust: 0.8
db:JVNDBid:JVNDB-2020-015923
Trust: 0.8
db:ZDI_CANid:ZDI-CAN-12163
Trust: 0.7
db:ICS CERTid:ICSA-21-040-06
Trust: 0.6
db:AUSCERTid:ESB-2021.0495
Trust: 0.6
db:CNNVDid:CNNVD-202102-869
Trust: 0.6
sources:
            
            
            ZDI: ZDI-21-230 // 
            
            
            
            JVNDB: JVNDB-2020-015923 // 
            
            
            
            NVD: CVE-2020-27004 // 
            
            
            
            CNNVD: CNNVD-202102-869

REFERENCES
url:https://www.zerodayinitiative.com/advisories/zdi-21-230/
Trust: 2.4
url:https://cert-portal.siemens.com/productcert/pdf/ssa-663999.pdf
Trust: 1.6
url:https://us-cert.cisa.gov/ics/advisories/icsa-21-040-06
Trust: 1.3
url:https://jvn.jp/vu/jvnvu91083521/
Trust: 0.8
url:https://nvd.nist.gov/vuln/detail/cve-2020-27004
Trust: 0.8
url:https://www.auscert.org.au/bulletins/esb-2021.0495
Trust: 0.6
sources:
            
            
            ZDI: ZDI-21-230 // 
            
            
            
            JVNDB: JVNDB-2020-015923 // 
            
            
            
            NVD: CVE-2020-27004 // 
            
            
            
            CNNVD: CNNVD-202102-869

CREDITS
Francis Provencher {PRL}
Trust: 0.7
sources:
            
            
            ZDI: ZDI-21-230

SOURCES
db:ZDIid:ZDI-21-230
db:JVNDBid:JVNDB-2020-015923
db:NVDid:CVE-2020-27004
db:CNNVDid:CNNVD-202102-869

LAST UPDATE DATE
2023-12-18T10:55:54.566000+00:00

SOURCES UPDATE DATE
db:ZDIid:ZDI-21-230date:2021-02-24T00:00:00
db:JVNDBid:JVNDB-2020-015923date:2021-10-25T06:20:00
db:NVDid:CVE-2020-27004date:2021-03-09T15:58:51.347
db:CNNVDid:CNNVD-202102-869date:2021-03-10T00:00:00

SOURCES RELEASE DATE
db:ZDIid:ZDI-21-230date:2021-02-24T00:00:00
db:JVNDBid:JVNDB-2020-015923date:2021-10-25T00:00:00
db:NVDid:CVE-2020-27004date:2021-02-09T17:15:14.203
db:CNNVDid:CNNVD-202102-869date:2021-02-09T00:00:00