Sign-up

ID

VAR-202112-0802


CVE

CVE-2021-44007


TITLE

Siemens Jt2go Security hole

Trust: 0.6

sources: CNNVD: CNNVD-202112-1198

DESCRIPTION

A vulnerability has been identified in JT2Go (All versions < V13.2.0.5), Teamcenter Visualization (All versions < V13.2.0.5). The Tiff_Loader.dll contains an off-by-one error in the heap while parsing specially crafted TIFF files. This could allow an attacker to cause a denial-of-service condition.

Trust: 1.0

sources: NVD: CVE-2021-44007

AFFECTED PRODUCTS

vendor:siemensmodel:jt2goscope:ltversion:13.2.0.5

Trust: 1.0

vendor:siemensmodel:teamcenter visualizationscope:ltversion:13.2.0.5

Trust: 1.0

sources: NVD: CVE-2021-44007

CVSS

SEVERITY

CVSSV2

CVSSV3

NVD: CVE-2021-44007
value: MEDIUM

Trust: 1.0

CNNVD: CNNVD-202112-1198
value: MEDIUM

Trust: 0.6

NVD:
severity: MEDIUM
baseScore: 4.3
vectorString: AV:N/AC:M/AU:N/C:N/I:N/A:P
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: PARTIAL
exploitabilityScore: 8.6
impactScore: 2.9
acInsufInfo: FALSE
obtainAllPrivilege: FALSE
obtainUserPrivilege: FALSE
obtainOtherPrivilege: FALSE
userInteractionRequired: TRUE
version: 2.0

Trust: 1.0

NVD:
baseSeverity: MEDIUM
baseScore: 5.5
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
exploitabilityScore: 1.8
impactScore: 3.6
version: 3.1

Trust: 1.0

sources: NVD: CVE-2021-44007 // CNNVD: CNNVD-202112-1198

PROBLEMTYPE DATA

problemtype:CWE-193

Trust: 1.0

sources: NVD: CVE-2021-44007

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-202112-1198

TYPE

other

Trust: 0.6

sources: CNNVD: CNNVD-202112-1198

CONFIGURATIONS

sources:
            
            
            NVD: CVE-2021-44007

PATCH
title:Siemens Jt2go Security vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=174913
Trust: 0.6
sources:
            
            
            CNNVD: CNNVD-202112-1198

EXTERNAL IDS
db:SIEMENSid:SSA-595101
Trust: 1.6
db:NVDid:CVE-2021-44007
Trust: 1.6
db:AUSCERTid:ESB-2021.4300
Trust: 0.6
db:CS-HELPid:SB2022010614
Trust: 0.6
db:ICS CERTid:ICSA-21-350-10
Trust: 0.6
db:CNNVDid:CNNVD-202112-1198
Trust: 0.6
sources:
            
            
            NVD: CVE-2021-44007 // 
            
            
            
            CNNVD: CNNVD-202112-1198

REFERENCES
url:https://cert-portal.siemens.com/productcert/pdf/ssa-595101.pdf
Trust: 1.6
url:https://us-cert.cisa.gov/ics/advisories/icsa-21-350-10
Trust: 0.6
url:https://www.auscert.org.au/bulletins/esb-2021.4300
Trust: 0.6
url:https://www.cybersecurity-help.cz/vdb/sb2022010614
Trust: 0.6
sources:
            
            
            NVD: CVE-2021-44007 // 
            
            
            
            CNNVD: CNNVD-202112-1198

CREDITS
Mat Powell of Trend Micro’s Zero Day Initiative and Jin Huang from ADLab reported these vulnerabilities.
Trust: 0.6
sources:
            
            
            CNNVD: CNNVD-202112-1198

SOURCES
db:NVDid:CVE-2021-44007
db:CNNVDid:CNNVD-202112-1198

LAST UPDATE DATE
2023-12-18T10:56:11.716000+00:00

SOURCES UPDATE DATE
db:NVDid:CVE-2021-44007date:2021-12-15T13:24:43.160
db:CNNVDid:CNNVD-202112-1198date:2022-01-07T00:00:00

SOURCES RELEASE DATE
db:NVDid:CVE-2021-44007date:2021-12-14T12:15:10.407
db:CNNVDid:CNNVD-202112-1198date:2021-12-14T00:00:00