Sign-up

ID

VAR-202112-0801


CVE

CVE-2021-44008


TITLE

Siemens Jt2go Buffer error vulnerability

Trust: 0.6

sources: CNNVD: CNNVD-202112-1199

DESCRIPTION

A vulnerability has been identified in JT2Go (All versions < V13.2.0.5), Teamcenter Visualization (All versions < V13.2.0.5). The Tiff_Loader.dll is vulnerable to an out of bounds read past the end of an allocated buffer when parsing TIFF files. An attacker could leverage this vulnerability to leak information in the context of the current process.

Trust: 1.0

sources: NVD: CVE-2021-44008

AFFECTED PRODUCTS

vendor:siemensmodel:jt2goscope:ltversion:13.2.0.5

Trust: 1.0

vendor:siemensmodel:teamcenter visualizationscope:ltversion:13.2.0.5

Trust: 1.0

sources: NVD: CVE-2021-44008

CVSS

SEVERITY

CVSSV2

CVSSV3

NVD: CVE-2021-44008
value: MEDIUM

Trust: 1.0

CNNVD: CNNVD-202112-1199
value: MEDIUM

Trust: 0.6

NVD:
severity: MEDIUM
baseScore: 4.3
vectorString: AV:N/AC:M/AU:N/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 8.6
impactScore: 2.9
acInsufInfo: FALSE
obtainAllPrivilege: FALSE
obtainUserPrivilege: FALSE
obtainOtherPrivilege: FALSE
userInteractionRequired: TRUE
version: 2.0

Trust: 1.0

NVD:
baseSeverity: MEDIUM
baseScore: 5.5
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 1.8
impactScore: 3.6
version: 3.1

Trust: 1.0

sources: NVD: CVE-2021-44008 // CNNVD: CNNVD-202112-1199

PROBLEMTYPE DATA

problemtype:CWE-125

Trust: 1.0

sources: NVD: CVE-2021-44008

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-202112-1199

TYPE

buffer error

Trust: 0.6

sources: CNNVD: CNNVD-202112-1199

CONFIGURATIONS

sources:
            
            
            NVD: CVE-2021-44008

PATCH
title:Siemens Jt2go Buffer error vulnerability fixurl:http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=174914
Trust: 0.6
sources:
            
            
            CNNVD: CNNVD-202112-1199

EXTERNAL IDS
db:SIEMENSid:SSA-595101
Trust: 1.6
db:NVDid:CVE-2021-44008
Trust: 1.6
db:CS-HELPid:SB2022010614
Trust: 0.6
db:ICS CERTid:ICSA-21-350-10
Trust: 0.6
db:AUSCERTid:ESB-2021.4300
Trust: 0.6
db:CNNVDid:CNNVD-202112-1199
Trust: 0.6
sources:
            
            
            NVD: CVE-2021-44008 // 
            
            
            
            CNNVD: CNNVD-202112-1199

REFERENCES
url:https://cert-portal.siemens.com/productcert/pdf/ssa-595101.pdf
Trust: 1.6
url:https://us-cert.cisa.gov/ics/advisories/icsa-21-350-10
Trust: 0.6
url:https://www.auscert.org.au/bulletins/esb-2021.4300
Trust: 0.6
url:https://www.cybersecurity-help.cz/vdb/sb2022010614
Trust: 0.6
sources:
            
            
            NVD: CVE-2021-44008 // 
            
            
            
            CNNVD: CNNVD-202112-1199

CREDITS
Mat Powell of Trend Micro’s Zero Day Initiative and Jin Huang from ADLab reported these vulnerabilities.
Trust: 0.6
sources:
            
            
            CNNVD: CNNVD-202112-1199

SOURCES
db:NVDid:CVE-2021-44008
db:CNNVDid:CNNVD-202112-1199

LAST UPDATE DATE
2023-12-18T11:14:07.778000+00:00

SOURCES UPDATE DATE
db:NVDid:CVE-2021-44008date:2021-12-15T13:23:51.913
db:CNNVDid:CNNVD-202112-1199date:2022-01-07T00:00:00

SOURCES RELEASE DATE
db:NVDid:CVE-2021-44008date:2021-12-14T12:15:10.457
db:CNNVDid:CNNVD-202112-1199date:2021-12-14T00:00:00