Sign-up

ID

VAR-202112-0800


CVE

CVE-2021-44009


TITLE

Siemens Jt2go Buffer error vulnerability

Trust: 0.6

sources: CNNVD: CNNVD-202112-1200

DESCRIPTION

A vulnerability has been identified in JT2Go (All versions < V13.2.0.5), Teamcenter Visualization (All versions < V13.2.0.5). The Tiff_Loader.dll is vulnerable to an out of bounds read past the end of an allocated buffer when parsing TIFF files. An attacker could leverage this vulnerability to leak information in the context of the current process.

Trust: 1.0

sources: NVD: CVE-2021-44009

AFFECTED PRODUCTS

vendor:siemensmodel:jt2goscope:ltversion:13.2.0.5

Trust: 1.0

vendor:siemensmodel:teamcenter visualizationscope:ltversion:13.2.0.5

Trust: 1.0

sources: NVD: CVE-2021-44009

CVSS

SEVERITY

CVSSV2

CVSSV3

NVD: CVE-2021-44009
value: MEDIUM

Trust: 1.0

CNNVD: CNNVD-202112-1200
value: MEDIUM

Trust: 0.6

NVD:
severity: MEDIUM
baseScore: 4.3
vectorString: AV:N/AC:M/AU:N/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 8.6
impactScore: 2.9
acInsufInfo: FALSE
obtainAllPrivilege: FALSE
obtainUserPrivilege: FALSE
obtainOtherPrivilege: FALSE
userInteractionRequired: TRUE
version: 2.0

Trust: 1.0

NVD:
baseSeverity: MEDIUM
baseScore: 5.5
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 1.8
impactScore: 3.6
version: 3.1

Trust: 1.0

sources: NVD: CVE-2021-44009 // CNNVD: CNNVD-202112-1200

PROBLEMTYPE DATA

problemtype:CWE-125

Trust: 1.0

sources: NVD: CVE-2021-44009

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-202112-1200

TYPE

buffer error

Trust: 0.6

sources: CNNVD: CNNVD-202112-1200

CONFIGURATIONS

sources:
            
            
            NVD: CVE-2021-44009

PATCH
title:Siemens Jt2go Buffer error vulnerability fixurl:http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=174915
Trust: 0.6
sources:
            
            
            CNNVD: CNNVD-202112-1200

EXTERNAL IDS
db:SIEMENSid:SSA-595101
Trust: 1.6
db:NVDid:CVE-2021-44009
Trust: 1.6
db:CS-HELPid:SB2022010614
Trust: 0.6
db:ICS CERTid:ICSA-21-350-10
Trust: 0.6
db:AUSCERTid:ESB-2021.4300
Trust: 0.6
db:CNNVDid:CNNVD-202112-1200
Trust: 0.6
sources:
            
            
            NVD: CVE-2021-44009 // 
            
            
            
            CNNVD: CNNVD-202112-1200

REFERENCES
url:https://cert-portal.siemens.com/productcert/pdf/ssa-595101.pdf
Trust: 1.6
url:https://us-cert.cisa.gov/ics/advisories/icsa-21-350-10
Trust: 0.6
url:https://www.auscert.org.au/bulletins/esb-2021.4300
Trust: 0.6
url:https://www.cybersecurity-help.cz/vdb/sb2022010614
Trust: 0.6
sources:
            
            
            NVD: CVE-2021-44009 // 
            
            
            
            CNNVD: CNNVD-202112-1200

CREDITS
Mat Powell of Trend Micro’s Zero Day Initiative and Jin Huang from ADLab reported these vulnerabilities.
Trust: 0.6
sources:
            
            
            CNNVD: CNNVD-202112-1200

SOURCES
db:NVDid:CVE-2021-44009
db:CNNVDid:CNNVD-202112-1200

LAST UPDATE DATE
2023-12-18T11:21:46.831000+00:00

SOURCES UPDATE DATE
db:NVDid:CVE-2021-44009date:2021-12-15T13:23:30.857
db:CNNVDid:CNNVD-202112-1200date:2022-01-07T00:00:00

SOURCES RELEASE DATE
db:NVDid:CVE-2021-44009date:2021-12-14T12:15:10.510
db:CNNVDid:CNNVD-202112-1200date:2021-12-14T00:00:00