Sign-up

ID

VAR-202112-0803


CVE

CVE-2021-44006


TITLE

Siemens Jt2go Jt2go Buffer error vulnerability

Trust: 0.6

sources: CNNVD: CNNVD-202112-1197

DESCRIPTION

A vulnerability has been identified in JT2Go (All versions < V13.2.0.5), Teamcenter Visualization (All versions < V13.2.0.5). The Tiff_Loader.dll contains an out of bounds write past the end of an allocated structure while parsing specially crafted TIFF files. This could allow an attacker to execute code in the context of the current process.

Trust: 1.0

sources: NVD: CVE-2021-44006

AFFECTED PRODUCTS

vendor:siemensmodel:jt2goscope:ltversion:13.2.0.5

Trust: 1.0

vendor:siemensmodel:teamcenter visualizationscope:ltversion:13.2.0.5

Trust: 1.0

sources: NVD: CVE-2021-44006

CVSS

SEVERITY

CVSSV2

CVSSV3

NVD: CVE-2021-44006
value: HIGH

Trust: 1.0

CNNVD: CNNVD-202112-1197
value: HIGH

Trust: 0.6

NVD:
severity: MEDIUM
baseScore: 6.8
vectorString: AV:N/AC:M/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 8.6
impactScore: 6.4
acInsufInfo: FALSE
obtainAllPrivilege: FALSE
obtainUserPrivilege: FALSE
obtainOtherPrivilege: FALSE
userInteractionRequired: TRUE
version: 2.0

Trust: 1.0

NVD:
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 1.8
impactScore: 5.9
version: 3.1

Trust: 1.0

sources: NVD: CVE-2021-44006 // CNNVD: CNNVD-202112-1197

PROBLEMTYPE DATA

problemtype:CWE-787

Trust: 1.0

sources: NVD: CVE-2021-44006

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-202112-1197

TYPE

buffer error

Trust: 0.6

sources: CNNVD: CNNVD-202112-1197

CONFIGURATIONS

sources:
            
            
            NVD: CVE-2021-44006

PATCH
title:Siemens Jt2go Jt2go Buffer error vulnerability fixurl:http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=174912
Trust: 0.6
sources:
            
            
            CNNVD: CNNVD-202112-1197

EXTERNAL IDS
db:SIEMENSid:SSA-595101
Trust: 1.6
db:NVDid:CVE-2021-44006
Trust: 1.6
db:CS-HELPid:SB2022010614
Trust: 0.6
db:ICS CERTid:ICSA-21-350-10
Trust: 0.6
db:AUSCERTid:ESB-2021.4300
Trust: 0.6
db:CNNVDid:CNNVD-202112-1197
Trust: 0.6
sources:
            
            
            NVD: CVE-2021-44006 // 
            
            
            
            CNNVD: CNNVD-202112-1197

REFERENCES
url:https://cert-portal.siemens.com/productcert/pdf/ssa-595101.pdf
Trust: 1.6
url:https://us-cert.cisa.gov/ics/advisories/icsa-21-350-10
Trust: 0.6
url:https://www.auscert.org.au/bulletins/esb-2021.4300
Trust: 0.6
url:https://www.cybersecurity-help.cz/vdb/sb2022010614
Trust: 0.6
sources:
            
            
            NVD: CVE-2021-44006 // 
            
            
            
            CNNVD: CNNVD-202112-1197

CREDITS
Mat Powell of Trend Micro’s Zero Day Initiative and Jin Huang from ADLab reported these vulnerabilities.
Trust: 0.6
sources:
            
            
            CNNVD: CNNVD-202112-1197

SOURCES
db:NVDid:CVE-2021-44006
db:CNNVDid:CNNVD-202112-1197

LAST UPDATE DATE
2023-12-18T11:52:06.976000+00:00

SOURCES UPDATE DATE
db:NVDid:CVE-2021-44006date:2021-12-15T13:25:06.327
db:CNNVDid:CNNVD-202112-1197date:2022-01-07T00:00:00

SOURCES RELEASE DATE
db:NVDid:CVE-2021-44006date:2021-12-14T12:15:10.353
db:CNNVDid:CNNVD-202112-1197date:2021-12-14T00:00:00