ID
VAR-202102-0327
CVE
CVE-2020-27006
TITLE
JT2Go and Teamcenter Visualization Out-of-bounds Vulnerability in Microsoft
Trust: 0.8
DESCRIPTION
A vulnerability has been identified in JT2Go (All versions < V13.1.0.1), Teamcenter Visualization (All versions < V13.1.0.1). Affected applications lack proper validation of user-supplied data when parsing of PCT files. This could result in a memory corruption condition. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-12182). JT2Go and Teamcenter Visualization Is vulnerable to an out-of-bounds write. Zero Day Initiative To this vulnerability ZDI-CAN-12182 Was numbered.Information is obtained, information is tampered with, and service is disrupted (DoS) It may be put into a state. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the parsing of PCT files. The Tenda AC18 is a router from the Chinese company Tenda
Trust: 2.79
IOT TAXONOMY
| category: | ['Network device'] | sub_category: | - | Trust: 0.6 |
AFFECTED PRODUCTS
| vendor: | siemens | model: | jt2go | scope: | lt | version: | 13.1.0.1 | Trust: 1.0 |
| vendor: | siemens | model: | teamcenter visualization | scope: | lt | version: | 13.1.0.1 | Trust: 1.0 |
| vendor: | シーメンス | model: | jt2go | scope: | - | version: | - | Trust: 0.8 |
| vendor: | シーメンス | model: | teamcenter visualization | scope: | eq | version: | 13.1.0.1 | Trust: 0.8 |
| vendor: | siemens | model: | jt2go | scope: | - | version: | - | Trust: 0.7 |
| vendor: | tenda | model: | ac18 | scope: | eq | version: | v15.03.05.05 | Trust: 0.6 |
CVSS
SEVERITY | CVSSV2 | CVSSV3 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
|
PROBLEMTYPE DATA
| problemtype: | CWE-119 | Trust: 1.0 |
| problemtype: | CWE-787 | Trust: 1.0 |
| problemtype: | Out-of-bounds writing (CWE-787) [NVD Evaluation ] | Trust: 0.8 |
THREAT TYPE
local
Trust: 0.6
TYPE
buffer error
Trust: 0.6
PATCH
| title: | SSA-663999 | url: | https://cert-portal.siemens.com/productcert/pdf/ssa-663999.pdf | Trust: 0.8 |
| title: | Siemens has issued an update to correct this vulnerability. | url: | https://us-cert.cisa.gov/ics/advisories/icsa-21-040-06 | Trust: 0.7 |
| title: | JT2Go Buffer error vulnerability fix | url: | http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=141286 | Trust: 0.6 |
EXTERNAL IDS
| db: | NVD | id: | CVE-2020-27006 | Trust: 3.7 |
| db: | ZDI | id: | ZDI-21-232 | Trust: 3.1 |
| db: | SIEMENS | id: | SSA-663999 | Trust: 1.6 |
| db: | JVN | id: | JVNVU91083521 | Trust: 0.8 |
| db: | JVNDB | id: | JVNDB-2020-015914 | Trust: 0.8 |
| db: | ZDI_CAN | id: | ZDI-CAN-12182 | Trust: 0.7 |
| db: | CNVD | id: | CNVD-2022-75821 | Trust: 0.6 |
| db: | ICS CERT | id: | ICSA-21-040-06 | Trust: 0.6 |
| db: | AUSCERT | id: | ESB-2021.0495 | Trust: 0.6 |
| db: | CNNVD | id: | CNNVD-202102-864 | Trust: 0.6 |
REFERENCES
| url: | https://www.zerodayinitiative.com/advisories/zdi-21-232/ | Trust: 2.4 |
| url: | https://cert-portal.siemens.com/productcert/pdf/ssa-663999.pdf | Trust: 1.6 |
| url: | https://nvd.nist.gov/vuln/detail/cve-2020-27006 | Trust: 1.4 |
| url: | https://us-cert.cisa.gov/ics/advisories/icsa-21-040-06 | Trust: 1.3 |
| url: | https://jvn.jp/vu/jvnvu91083521/ | Trust: 0.8 |
| url: | https://www.auscert.org.au/bulletins/esb-2021.0495 | Trust: 0.6 |
CREDITS
Francis Provencher {PRL}
Trust: 0.7
SOURCES
| db: | ZDI | id: | ZDI-21-232 |
| db: | CNVD | id: | CNVD-2022-75821 |
| db: | JVNDB | id: | JVNDB-2020-015914 |
| db: | CNNVD | id: | CNNVD-202102-864 |
| db: | NVD | id: | CVE-2020-27006 |
LAST UPDATE DATE
2024-08-14T12:39:05.990000+00:00
SOURCES UPDATE DATE
| db: | ZDI | id: | ZDI-21-232 | date: | 2021-02-24T00:00:00 |
| db: | CNVD | id: | CNVD-2022-75821 | date: | 2022-11-10T00:00:00 |
| db: | JVNDB | id: | JVNDB-2020-015914 | date: | 2021-10-22T08:12:00 |
| db: | CNNVD | id: | CNNVD-202102-864 | date: | 2021-10-19T00:00:00 |
| db: | NVD | id: | CVE-2020-27006 | date: | 2021-10-18T12:53:16.107 |
SOURCES RELEASE DATE
| db: | ZDI | id: | ZDI-21-232 | date: | 2021-02-24T00:00:00 |
| db: | CNVD | id: | CNVD-2022-75821 | date: | 2022-11-10T00:00:00 |
| db: | JVNDB | id: | JVNDB-2020-015914 | date: | 2021-10-22T00:00:00 |
| db: | CNNVD | id: | CNNVD-202102-864 | date: | 2021-02-09T00:00:00 |
| db: | NVD | id: | CVE-2020-27006 | date: | 2021-02-09T17:15:14.343 |