Sign-up

ID

VAR-202107-1382


CVE

CVE-2021-34298


TITLE

JT2Go  and  Teamcenter Visualization  Input confirmation vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2021-009340

DESCRIPTION

A vulnerability has been identified in JT2Go (All versions < V13.2), Teamcenter Visualization (All versions < V13.2). The BMP_Loader.dll library in affected applications lacks proper validation of user-supplied data prior to performing further free operations on an object when parsing BMP files. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-13060). JT2Go and Teamcenter Visualization There is a vulnerability related to input verification and a vulnerability related to the use of freed memory. Zero Day Initiative To this vulnerability ZDI-CAN-13060 Was numbered.Information is obtained, information is tampered with, and service is disrupted (DoS) It may be put into a state. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the parsing of BMP files

Trust: 2.34

sources: NVD: CVE-2021-34298 // JVNDB: JVNDB-2021-009340 // ZDI: ZDI-21-872 // VULMON: CVE-2021-34298

AFFECTED PRODUCTS

vendor:siemensmodel:jt2goscope:ltversion:13.2.0

Trust: 1.0

vendor:siemensmodel:teamcenter visualizationscope:ltversion:13.2.0

Trust: 1.0

vendor:シーメンスmodel:teamcenter visualizationscope:eqversion:13.2

Trust: 0.8

vendor:シーメンスmodel:jt2goscope: - version: -

Trust: 0.8

vendor:siemensmodel:jt2goscope: - version: -

Trust: 0.7

sources: ZDI: ZDI-21-872 // JVNDB: JVNDB-2021-009340 // NVD: CVE-2021-34298

CVSS

SEVERITY

CVSSV2

CVSSV3

NVD: CVE-2021-34298
value: HIGH

Trust: 1.8

ZDI: CVE-2021-34298
value: HIGH

Trust: 0.7

CNNVD: CNNVD-202107-873
value: HIGH

Trust: 0.6

VULMON: CVE-2021-34298
value: MEDIUM

Trust: 0.1

NVD:
severity: MEDIUM
baseScore: 6.8
vectorString: AV:N/AC:M/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 8.6
impactScore: 6.4
acInsufInfo: FALSE
obtainAllPrivilege: FALSE
obtainUserPrivilege: FALSE
obtainOtherPrivilege: FALSE
userInteractionRequired: TRUE
version: 2.0

Trust: 1.0

NVD: CVE-2021-34298
severity: MEDIUM
baseScore: 6.8
vectorString: AV:N/AC:M/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: NONE
impactScore: NONE
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.9

NVD:
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 1.8
impactScore: 5.9
version: 3.1

Trust: 1.0

NVD: CVE-2021-34298
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

ZDI: CVE-2021-34298
baseSeverity: HIGH
baseScore: 7.8
vectorString: AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 1.8
impactScore: 5.9
version: 3.0

Trust: 0.7

sources: ZDI: ZDI-21-872 // VULMON: CVE-2021-34298 // JVNDB: JVNDB-2021-009340 // NVD: CVE-2021-34298 // CNNVD: CNNVD-202107-873

PROBLEMTYPE DATA

problemtype:CWE-416

Trust: 1.0

problemtype:Incorrect input confirmation (CWE-20) [NVD Evaluation ]

Trust: 0.8

problemtype: Use of freed memory (CWE-416) [NVD Evaluation ]

Trust: 0.8

sources: JVNDB: JVNDB-2021-009340 // NVD: CVE-2021-34298

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-202107-873

TYPE

resource management error

Trust: 0.6

sources: CNNVD: CNNVD-202107-873

CONFIGURATIONS

sources:
            
            
            NVD: CVE-2021-34298

PATCH
title:SSA-483182url:https://cert-portal.siemens.com/productcert/pdf/ssa-483182.pdf
Trust: 0.8
title: - url:https://us-cert.cisa.gov/ics/advisories/icsa-21-194-15https://cert-portal.siemens.com/productcert/pdf/ssa-483182.pdf
Trust: 0.7
title:Siemens Jt2go  and  Siemens Teamcenter Visualization Remediation of resource management error vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=156566
Trust: 0.6
title:Siemens Security Advisories: Siemens Security Advisoryurl:https://vulmon.com/vendoradvisory?qidtp=siemens_security_advisories&qid=aa85c53444a3e0726ddb55922c9060c8
Trust: 0.1
sources:
            
            
            ZDI: ZDI-21-872 // 
            
            
            
            VULMON: CVE-2021-34298 // 
            
            
            
            JVNDB: JVNDB-2021-009340 // 
            
            
            
            CNNVD: CNNVD-202107-873

EXTERNAL IDS
db:NVDid:CVE-2021-34298
Trust: 4.0
db:ZDIid:ZDI-21-872
Trust: 3.2
db:SIEMENSid:SSA-483182
Trust: 1.7
db:JVNDBid:JVNDB-2021-009340
Trust: 0.8
db:ZDI_CANid:ZDI-CAN-13060
Trust: 0.7
db:ICS CERTid:ICSA-21-194-15
Trust: 0.6
db:CNNVDid:CNNVD-202107-873
Trust: 0.6
db:VULMONid:CVE-2021-34298
Trust: 0.1
sources:
            
            
            ZDI: ZDI-21-872 // 
            
            
            
            VULMON: CVE-2021-34298 // 
            
            
            
            JVNDB: JVNDB-2021-009340 // 
            
            
            
            NVD: CVE-2021-34298 // 
            
            
            
            CNNVD: CNNVD-202107-873

REFERENCES
url:https://www.zerodayinitiative.com/advisories/zdi-21-872/
Trust: 2.5
url:https://cert-portal.siemens.com/productcert/pdf/ssa-483182.pdf
Trust: 1.7
url:https://nvd.nist.gov/vuln/detail/cve-2021-34298
Trust: 0.8
url:https://us-cert.cisa.gov/ics/advisories/icsa-21-194-15https://cert-portal.siemens.com/productcert/pdf/ssa-483182.pdf
Trust: 0.7
url:https://us-cert.cisa.gov/ics/advisories/icsa-21-194-15
Trust: 0.6
url:https://cwe.mitre.org/data/definitions/20.html
Trust: 0.1
url:https://nvd.nist.gov
Trust: 0.1
sources:
            
            
            ZDI: ZDI-21-872 // 
            
            
            
            VULMON: CVE-2021-34298 // 
            
            
            
            JVNDB: JVNDB-2021-009340 // 
            
            
            
            NVD: CVE-2021-34298 // 
            
            
            
            CNNVD: CNNVD-202107-873

CREDITS
xina1i at SecZone
Trust: 0.7
sources:
            
            
            ZDI: ZDI-21-872

SOURCES
db:ZDIid:ZDI-21-872
db:VULMONid:CVE-2021-34298
db:JVNDBid:JVNDB-2021-009340
db:NVDid:CVE-2021-34298
db:CNNVDid:CNNVD-202107-873

LAST UPDATE DATE
2023-12-18T11:16:00.221000+00:00

SOURCES UPDATE DATE
db:ZDIid:ZDI-21-872date:2021-07-19T00:00:00
db:VULMONid:CVE-2021-34298date:2021-07-19T00:00:00
db:JVNDBid:JVNDB-2021-009340date:2022-04-20T09:04:00
db:NVDid:CVE-2021-34298date:2021-07-27T14:31:29.447
db:CNNVDid:CNNVD-202107-873date:2021-08-02T00:00:00

SOURCES RELEASE DATE
db:ZDIid:ZDI-21-872date:2021-07-19T00:00:00
db:VULMONid:CVE-2021-34298date:2021-07-13T00:00:00
db:JVNDBid:JVNDB-2021-009340date:2022-04-20T00:00:00
db:NVDid:CVE-2021-34298date:2021-07-13T11:15:10.747
db:CNNVDid:CNNVD-202107-873date:2021-07-13T00:00:00