Sign-up

ID

VAR-202112-0804


CVE

CVE-2021-44005


TITLE

Siemens Jt2go Buffer error vulnerability

Trust: 0.6

sources: CNNVD: CNNVD-202112-1196

DESCRIPTION

A vulnerability has been identified in JT2Go (All versions < V13.2.0.5), Teamcenter Visualization (All versions < V13.2.0.5). The Tiff_Loader.dll contains an out of bounds write past the end of an allocated structure while parsing specially crafted TIFF files. This could allow an attacker to execute code in the context of the current process.

Trust: 1.0

sources: NVD: CVE-2021-44005

AFFECTED PRODUCTS

vendor:siemensmodel:jt2goscope:ltversion:13.2.0.5

Trust: 1.0

vendor:siemensmodel:teamcenter visualizationscope:ltversion:13.2.0.5

Trust: 1.0

sources: NVD: CVE-2021-44005

CVSS

SEVERITY

CVSSV2

CVSSV3

NVD: CVE-2021-44005
value: HIGH

Trust: 1.0

CNNVD: CNNVD-202112-1196
value: HIGH

Trust: 0.6

NVD:
severity: MEDIUM
baseScore: 6.8
vectorString: AV:N/AC:M/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 8.6
impactScore: 6.4
acInsufInfo: FALSE
obtainAllPrivilege: FALSE
obtainUserPrivilege: FALSE
obtainOtherPrivilege: FALSE
userInteractionRequired: TRUE
version: 2.0

Trust: 1.0

NVD:
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 1.8
impactScore: 5.9
version: 3.1

Trust: 1.0

sources: NVD: CVE-2021-44005 // CNNVD: CNNVD-202112-1196

PROBLEMTYPE DATA

problemtype:CWE-787

Trust: 1.0

sources: NVD: CVE-2021-44005

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-202112-1196

TYPE

buffer error

Trust: 0.6

sources: CNNVD: CNNVD-202112-1196

CONFIGURATIONS

sources:
            
            
            NVD: CVE-2021-44005

PATCH
title:Siemens Jt2go Buffer error vulnerability fixurl:http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=175270
Trust: 0.6
sources:
            
            
            CNNVD: CNNVD-202112-1196

EXTERNAL IDS
db:SIEMENSid:SSA-595101
Trust: 1.6
db:NVDid:CVE-2021-44005
Trust: 1.6
db:CS-HELPid:SB2022010614
Trust: 0.6
db:ICS CERTid:ICSA-21-350-10
Trust: 0.6
db:AUSCERTid:ESB-2021.4300
Trust: 0.6
db:CNNVDid:CNNVD-202112-1196
Trust: 0.6
sources:
            
            
            NVD: CVE-2021-44005 // 
            
            
            
            CNNVD: CNNVD-202112-1196

REFERENCES
url:https://cert-portal.siemens.com/productcert/pdf/ssa-595101.pdf
Trust: 1.6
url:https://nvd.nist.gov/vuln/detail/cve-2021-44005
Trust: 0.6
url:https://us-cert.cisa.gov/ics/advisories/icsa-21-350-10
Trust: 0.6
url:https://www.auscert.org.au/bulletins/esb-2021.4300
Trust: 0.6
url:https://www.cybersecurity-help.cz/vdb/sb2022010614
Trust: 0.6
sources:
            
            
            NVD: CVE-2021-44005 // 
            
            
            
            CNNVD: CNNVD-202112-1196

CREDITS
Mat Powell of Trend Micro’s Zero Day Initiative and Jin Huang from ADLab reported these vulnerabilities.
Trust: 0.6
sources:
            
            
            CNNVD: CNNVD-202112-1196

SOURCES
db:NVDid:CVE-2021-44005
db:CNNVDid:CNNVD-202112-1196

LAST UPDATE DATE
2023-12-18T11:43:41.519000+00:00

SOURCES UPDATE DATE
db:NVDid:CVE-2021-44005date:2021-12-15T13:26:57.377
db:CNNVDid:CNNVD-202112-1196date:2022-01-07T00:00:00

SOURCES RELEASE DATE
db:NVDid:CVE-2021-44005date:2021-12-14T12:15:10.300
db:CNNVDid:CNNVD-202112-1196date:2021-12-14T00:00:00