Sign-up

ID

VAR-202112-0805


CVE

CVE-2021-44004


TITLE

JT2Go  and  Teamcenter Visualization  Out-of-bounds read vulnerability in

Trust: 0.8

sources: JVNDB: JVNDB-2021-016220

DESCRIPTION

A vulnerability has been identified in JT2Go (All versions < V13.2.0.5), Teamcenter Visualization (All versions < V13.2.0.5). The Tiff_Loader.dll is vulnerable to an out of bounds read past the end of an allocated buffer when parsing TIFF files. An attacker could leverage this vulnerability to leak information in the context of the current process. JT2Go and Teamcenter Visualization Exists in an out-of-bounds read vulnerability.Information may be obtained

Trust: 1.62

sources: NVD: CVE-2021-44004 // JVNDB: JVNDB-2021-016220

AFFECTED PRODUCTS

vendor:siemensmodel:jt2goscope:ltversion:13.2.0.5

Trust: 1.0

vendor:siemensmodel:teamcenter visualizationscope:ltversion:13.2.0.5

Trust: 1.0

vendor:シーメンスmodel:teamcenter visualizationscope:eqversion:13.2.0.5

Trust: 0.8

vendor:シーメンスmodel:jt2goscope: - version: -

Trust: 0.8

sources: JVNDB: JVNDB-2021-016220 // NVD: CVE-2021-44004

CVSS

SEVERITY

CVSSV2

CVSSV3

NVD: CVE-2021-44004
value: MEDIUM

Trust: 1.8

CNNVD: CNNVD-202112-1195
value: MEDIUM

Trust: 0.6

NVD:
severity: MEDIUM
baseScore: 4.3
vectorString: AV:N/AC:M/AU:N/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 8.6
impactScore: 2.9
acInsufInfo: FALSE
obtainAllPrivilege: FALSE
obtainUserPrivilege: FALSE
obtainOtherPrivilege: FALSE
userInteractionRequired: TRUE
version: 2.0

Trust: 1.0

NVD: CVE-2021-44004
severity: MEDIUM
baseScore: 4.3
vectorString: AV:N/AC:M/AU:N/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: NONE
impactScore: NONE
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.8

NVD:
baseSeverity: MEDIUM
baseScore: 5.5
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 1.8
impactScore: 3.6
version: 3.1

Trust: 1.0

NVD: CVE-2021-44004
baseSeverity: MEDIUM
baseScore: 5.5
vectorString: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: JVNDB: JVNDB-2021-016220 // NVD: CVE-2021-44004 // CNNVD: CNNVD-202112-1195

PROBLEMTYPE DATA

problemtype:CWE-125

Trust: 1.0

problemtype:Out-of-bounds read (CWE-125) [NVD evaluation ]

Trust: 0.8

sources: JVNDB: JVNDB-2021-016220 // NVD: CVE-2021-44004

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-202112-1195

TYPE

buffer error

Trust: 0.6

sources: CNNVD: CNNVD-202112-1195

CONFIGURATIONS

sources:
            
            
            NVD: CVE-2021-44004

PATCH
title:SSA-595101url:https://cert-portal.siemens.com/productcert/pdf/ssa-595101.pdf
Trust: 0.8
title:Siemens Jt2go Buffer error vulnerability fixurl:http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=175269
Trust: 0.6
sources:
            
            
            JVNDB: JVNDB-2021-016220 // 
            
            
            
            CNNVD: CNNVD-202112-1195

EXTERNAL IDS
db:NVDid:CVE-2021-44004
Trust: 3.2
db:SIEMENSid:SSA-595101
Trust: 1.6
db:JVNDBid:JVNDB-2021-016220
Trust: 0.8
db:CS-HELPid:SB2022010614
Trust: 0.6
db:ICS CERTid:ICSA-21-350-10
Trust: 0.6
db:AUSCERTid:ESB-2021.4300
Trust: 0.6
db:CNNVDid:CNNVD-202112-1195
Trust: 0.6
sources:
            
            
            JVNDB: JVNDB-2021-016220 // 
            
            
            
            NVD: CVE-2021-44004 // 
            
            
            
            CNNVD: CNNVD-202112-1195

REFERENCES
url:https://cert-portal.siemens.com/productcert/pdf/ssa-595101.pdf
Trust: 1.6
url:https://nvd.nist.gov/vuln/detail/cve-2021-44004
Trust: 1.4
url:https://us-cert.cisa.gov/ics/advisories/icsa-21-350-10
Trust: 0.6
url:https://www.auscert.org.au/bulletins/esb-2021.4300
Trust: 0.6
url:https://www.cybersecurity-help.cz/vdb/sb2022010614
Trust: 0.6
sources:
            
            
            JVNDB: JVNDB-2021-016220 // 
            
            
            
            NVD: CVE-2021-44004 // 
            
            
            
            CNNVD: CNNVD-202112-1195

CREDITS
Mat Powell of Trend Micro’s Zero Day Initiative and Jin Huang from ADLab reported these vulnerabilities.
Trust: 0.6
sources:
            
            
            CNNVD: CNNVD-202112-1195

SOURCES
db:JVNDBid:JVNDB-2021-016220
db:NVDid:CVE-2021-44004
db:CNNVDid:CNNVD-202112-1195

LAST UPDATE DATE
2023-12-18T11:21:33.702000+00:00

SOURCES UPDATE DATE
db:JVNDBid:JVNDB-2021-016220date:2022-12-08T05:17:00
db:NVDid:CVE-2021-44004date:2021-12-15T13:26:39.887
db:CNNVDid:CNNVD-202112-1195date:2022-01-07T00:00:00

SOURCES RELEASE DATE
db:JVNDBid:JVNDB-2021-016220date:2022-12-08T00:00:00
db:NVDid:CVE-2021-44004date:2021-12-14T12:15:10.250
db:CNNVDid:CNNVD-202112-1195date:2021-12-14T00:00:00