Details of VAR-202102-0328

ID

VAR-202102-0328

CVE

CVE-2020-27007

TITLE

Siemens JT2Go HPG File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability

Trust: 1.4

sources: ZDI: ZDI-21-234 // ZDI: ZDI-21-233

DESCRIPTION

A vulnerability has been identified in JT2Go (All versions < V13.1.0.1), Teamcenter Visualization (All versions < V13.1.0.1). Affected applications lack proper validation of user-supplied data when parsing of HPG files. This could result in a memory access past the end of an allocated buffer. An attacker could leverage this vulnerability to access data in the context of the current process. (ZDI-CAN-12207). JT2Go and Teamcenter Visualization Is vulnerable to an out-of-bounds read. Zero Day Initiative To this vulnerability ZDI-CAN-12207 Was numbered.Information may be obtained. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Siemens JT2Go. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the parsing of HPG files

Trust: 2.88

sources: NVD: CVE-2020-27007 // JVNDB: JVNDB-2020-015913 // ZDI: ZDI-21-234 // ZDI: ZDI-21-233

AFFECTED PRODUCTS

vendor:	siemens	model:	jt2go	scope:	-	version:	-	Trust: 1.4
vendor:	siemens	model:	teamcenter visualization	scope:	lt	version:	13.1.0.1	Trust: 1.0
vendor:	siemens	model:	jt2go	scope:	lt	version:	13.1.0.1	Trust: 1.0
vendor:	シーメンス	model:	jt2go	scope:	-	version:	-	Trust: 0.8
vendor:	シーメンス	model:	teamcenter visualization	scope:	eq	version:	13.1.0.1	Trust: 0.8

sources: ZDI: ZDI-21-234 // ZDI: ZDI-21-233 // JVNDB: JVNDB-2020-015913 // NVD: CVE-2020-27007

CVSS

SEVERITY

CVSSV2

CVSSV3

NVD:	CVE-2020-27007
value:	MEDIUM
Trust: 1.8
ZDI:	CVE-2020-27007
value:	LOW
Trust: 1.4
CNNVD:	CNNVD-202102-867
value:	MEDIUM
Trust: 0.6

NVD:
severity:	MEDIUM
baseScore:	4.3
vectorString:	AV:N/AC:M/AU:N/C:P/I:N/A:N
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	8.6
impactScore:	2.9
acInsufInfo:	FALSE
obtainAllPrivilege:	FALSE
obtainUserPrivilege:	FALSE
obtainOtherPrivilege:	FALSE
userInteractionRequired:	TRUE
version:	2.0
Trust: 1.0
NVD:	CVE-2020-27007
severity:	MEDIUM
baseScore:	4.3
vectorString:	AV:N/AC:M/AU:N/C:P/I:N/A:N
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	NONE
impactScore:	NONE
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.8

ZDI:	CVE-2020-27007
baseSeverity:	LOW
baseScore:	3.3
vectorString:	AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
attackVector:	LOCAL
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	REQUIRED
scope:	UNCHANGED
confidentialityImpact:	LOW
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	1.8
impactScore:	1.4
version:	3.0
Trust: 1.4
NVD:
baseSeverity:	MEDIUM
baseScore:	5.5
vectorString:	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
attackVector:	LOCAL
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	REQUIRED
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	1.8
impactScore:	3.6
version:	3.1
Trust: 1.0
NVD:	CVE-2020-27007
baseSeverity:	MEDIUM
baseScore:	5.5
vectorString:	CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
attackVector:	LOCAL
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	REQUIRED
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: ZDI: ZDI-21-234 // ZDI: ZDI-21-233 // JVNDB: JVNDB-2020-015913 // NVD: CVE-2020-27007 // CNNVD: CNNVD-202102-867

PROBLEMTYPE DATA

problemtype:	CWE-125	Trust: 1.0
problemtype:	Out-of-bounds read (CWE-125) [NVD Evaluation ]	Trust: 0.8

sources: JVNDB: JVNDB-2020-015913 // NVD: CVE-2020-27007

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-202102-867

TYPE

buffer error

Trust: 0.6

sources: CNNVD: CNNVD-202102-867

CONFIGURATIONS

sources: NVD: CVE-2020-27007

PATCH

title:	Siemens has issued an update to correct this vulnerability.	url:	https://us-cert.cisa.gov/ics/advisories/icsa-21-040-06	Trust: 1.4
title:	SSA-663999	url:	https://cert-portal.siemens.com/productcert/pdf/ssa-663999.pdf	Trust: 0.8
title:	JT2Go Buffer error vulnerability fix	url:	http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=141289	Trust: 0.6

sources: ZDI: ZDI-21-234 // ZDI: ZDI-21-233 // JVNDB: JVNDB-2020-015913 // CNNVD: CNNVD-202102-867

EXTERNAL IDS

db:	NVD	id:	CVE-2020-27007	Trust: 3.8
db:	ZDI	id:	ZDI-21-234	Trust: 3.1
db:	ZDI	id:	ZDI-21-233	Trust: 3.1
db:	SIEMENS	id:	SSA-663999	Trust: 1.6
db:	JVN	id:	JVNVU91083521	Trust: 0.8
db:	JVNDB	id:	JVNDB-2020-015913	Trust: 0.8
db:	ZDI_CAN	id:	ZDI-CAN-12208	Trust: 0.7
db:	ZDI_CAN	id:	ZDI-CAN-12207	Trust: 0.7
db:	ICS CERT	id:	ICSA-21-040-06	Trust: 0.6
db:	AUSCERT	id:	ESB-2021.0495	Trust: 0.6
db:	CNNVD	id:	CNNVD-202102-867	Trust: 0.6

sources: ZDI: ZDI-21-234 // ZDI: ZDI-21-233 // JVNDB: JVNDB-2020-015913 // NVD: CVE-2020-27007 // CNNVD: CNNVD-202102-867

REFERENCES

url:	https://www.zerodayinitiative.com/advisories/zdi-21-233/	Trust: 2.4
url:	https://www.zerodayinitiative.com/advisories/zdi-21-234/	Trust: 2.4
url:	https://us-cert.cisa.gov/ics/advisories/icsa-21-040-06	Trust: 2.0
url:	https://cert-portal.siemens.com/productcert/pdf/ssa-663999.pdf	Trust: 1.6
url:	https://jvn.jp/vu/jvnvu91083521/	Trust: 0.8
url:	https://nvd.nist.gov/vuln/detail/cve-2020-27007	Trust: 0.8
url:	https://www.auscert.org.au/bulletins/esb-2021.0495	Trust: 0.6

sources: ZDI: ZDI-21-234 // ZDI: ZDI-21-233 // JVNDB: JVNDB-2020-015913 // NVD: CVE-2020-27007 // CNNVD: CNNVD-202102-867

CREDITS

Francis Provencher {PRL}

Trust: 1.4

sources: ZDI: ZDI-21-234 // ZDI: ZDI-21-233

SOURCES

db:	ZDI	id:	ZDI-21-234
db:	ZDI	id:	ZDI-21-233
db:	JVNDB	id:	JVNDB-2020-015913
db:	NVD	id:	CVE-2020-27007
db:	CNNVD	id:	CNNVD-202102-867

LAST UPDATE DATE

2023-12-18T10:54:22.176000+00:00

SOURCES UPDATE DATE

db:	ZDI	id:	ZDI-21-234	date:	2021-02-24T00:00:00
db:	ZDI	id:	ZDI-21-233	date:	2021-02-24T00:00:00
db:	JVNDB	id:	JVNDB-2020-015913	date:	2021-10-22T07:25:00
db:	NVD	id:	CVE-2020-27007	date:	2021-03-05T18:42:30.297
db:	CNNVD	id:	CNNVD-202102-867	date:	2021-03-08T00:00:00

SOURCES RELEASE DATE

db:	ZDI	id:	ZDI-21-234	date:	2021-02-24T00:00:00
db:	ZDI	id:	ZDI-21-233	date:	2021-02-24T00:00:00
db:	JVNDB	id:	JVNDB-2020-015913	date:	2021-10-22T00:00:00
db:	NVD	id:	CVE-2020-27007	date:	2021-02-09T17:15:14.407
db:	CNNVD	id:	CNNVD-202102-867	date:	2021-02-09T00:00:00