Sign-up

ID

VAR-202112-0799


CVE

CVE-2021-44010


TITLE

Siemens Jt2go Buffer error vulnerability

Trust: 0.6

sources: CNNVD: CNNVD-202112-1201

DESCRIPTION

A vulnerability has been identified in JT2Go (All versions < V13.2.0.5), Teamcenter Visualization (All versions < V13.2.0.5). The Tiff_Loader.dll is vulnerable to an out of bounds read past the end of an allocated buffer when parsing TIFF files. An attacker could leverage this vulnerability to leak information in the context of the current process.

Trust: 1.0

sources: NVD: CVE-2021-44010

AFFECTED PRODUCTS

vendor:siemensmodel:jt2goscope:ltversion:13.2.0.5

Trust: 1.0

vendor:siemensmodel:teamcenter visualizationscope:ltversion:13.2.0.5

Trust: 1.0

sources: NVD: CVE-2021-44010

CVSS

SEVERITY

CVSSV2

CVSSV3

NVD: CVE-2021-44010
value: MEDIUM

Trust: 1.0

CNNVD: CNNVD-202112-1201
value: MEDIUM

Trust: 0.6

NVD:
severity: MEDIUM
baseScore: 4.3
vectorString: AV:N/AC:M/AU:N/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 8.6
impactScore: 2.9
acInsufInfo: FALSE
obtainAllPrivilege: FALSE
obtainUserPrivilege: FALSE
obtainOtherPrivilege: FALSE
userInteractionRequired: TRUE
version: 2.0

Trust: 1.0

NVD:
baseSeverity: MEDIUM
baseScore: 5.5
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 1.8
impactScore: 3.6
version: 3.1

Trust: 1.0

sources: NVD: CVE-2021-44010 // CNNVD: CNNVD-202112-1201

PROBLEMTYPE DATA

problemtype:CWE-125

Trust: 1.0

sources: NVD: CVE-2021-44010

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-202112-1201

TYPE

buffer error

Trust: 0.6

sources: CNNVD: CNNVD-202112-1201

CONFIGURATIONS

sources:
            
            
            NVD: CVE-2021-44010

PATCH
title:Siemens Jt2go Buffer error vulnerability fixurl:http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=174916
Trust: 0.6
sources:
            
            
            CNNVD: CNNVD-202112-1201

EXTERNAL IDS
db:SIEMENSid:SSA-595101
Trust: 1.6
db:NVDid:CVE-2021-44010
Trust: 1.6
db:CS-HELPid:SB2022010614
Trust: 0.6
db:ICS CERTid:ICSA-21-350-10
Trust: 0.6
db:AUSCERTid:ESB-2021.4300
Trust: 0.6
db:CNNVDid:CNNVD-202112-1201
Trust: 0.6
sources:
            
            
            NVD: CVE-2021-44010 // 
            
            
            
            CNNVD: CNNVD-202112-1201

REFERENCES
url:https://cert-portal.siemens.com/productcert/pdf/ssa-595101.pdf
Trust: 1.6
url:https://us-cert.cisa.gov/ics/advisories/icsa-21-350-10
Trust: 0.6
url:https://www.auscert.org.au/bulletins/esb-2021.4300
Trust: 0.6
url:https://www.cybersecurity-help.cz/vdb/sb2022010614
Trust: 0.6
sources:
            
            
            NVD: CVE-2021-44010 // 
            
            
            
            CNNVD: CNNVD-202112-1201

CREDITS
Mat Powell of Trend Micro’s Zero Day Initiative and Jin Huang from ADLab reported these vulnerabilities.
Trust: 0.6
sources:
            
            
            CNNVD: CNNVD-202112-1201

SOURCES
db:NVDid:CVE-2021-44010
db:CNNVDid:CNNVD-202112-1201

LAST UPDATE DATE
2023-12-18T11:27:24.638000+00:00

SOURCES UPDATE DATE
db:NVDid:CVE-2021-44010date:2021-12-15T13:23:02.493
db:CNNVDid:CNNVD-202112-1201date:2022-01-07T00:00:00

SOURCES RELEASE DATE
db:NVDid:CVE-2021-44010date:2021-12-14T12:15:10.563
db:CNNVDid:CNNVD-202112-1201date:2021-12-14T00:00:00