Details of VAR-202309-0578

ID

VAR-202309-0578

CVE

CVE-2023-38074

TITLE

Siemens Tecnomatix Plant Simulation WRL File Parsing Type Confusion Remote Code Execution Vulnerability

Trust: 0.7

sources: ZDI: ZDI-23-1628

DESCRIPTION

A vulnerability has been identified in JT2Go (All versions < V14.3.0.1), Teamcenter Visualization V13.3 (All versions < V13.3.0.12), Teamcenter Visualization V14.0 (All versions), Teamcenter Visualization V14.1 (All versions < V14.1.0.11), Teamcenter Visualization V14.2 (All versions < V14.2.0.6), Teamcenter Visualization V14.3 (All versions < V14.3.0.1), Tecnomatix Plant Simulation V2201 (All versions < V2201.0010), Tecnomatix Plant Simulation V2302 (All versions < V2302.0004). The affected application contains a type confusion vulnerability while parsing WRL files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-20840). This vulnerability allows remote attackers to execute arbitrary code on affected installations of Siemens Tecnomatix Plant Simulation. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the parsing of WRL files. The issue results from the lack of proper validation of user-supplied data, which can result in a type confusion condition

Trust: 1.62

sources: NVD: CVE-2023-38074 // ZDI: ZDI-23-1628 // VULMON: CVE-2023-38074

AFFECTED PRODUCTS

vendor:	siemens	model:	teamcenter visualization	scope:	gte	version:	14.0	Trust: 1.0
vendor:	siemens	model:	tecnomatix plant simulation	scope:	gte	version:	2201.0	Trust: 1.0
vendor:	siemens	model:	tecnomatix plant simulation	scope:	lt	version:	2302.0004	Trust: 1.0
vendor:	siemens	model:	teamcenter visualization	scope:	gte	version:	13.3.0	Trust: 1.0
vendor:	siemens	model:	teamcenter visualization	scope:	lt	version:	14.2.0.6	Trust: 1.0
vendor:	siemens	model:	teamcenter visualization	scope:	gte	version:	14.3	Trust: 1.0
vendor:	siemens	model:	jt2go	scope:	lt	version:	14.3.0.1	Trust: 1.0
vendor:	siemens	model:	teamcenter visualization	scope:	lt	version:	13.4.0.12	Trust: 1.0
vendor:	siemens	model:	tecnomatix plant simulation	scope:	lt	version:	2201.0010	Trust: 1.0
vendor:	siemens	model:	teamcenter visualization	scope:	lt	version:	14.3.0.1	Trust: 1.0
vendor:	siemens	model:	teamcenter visualization	scope:	gte	version:	14.2	Trust: 1.0
vendor:	siemens	model:	teamcenter visualization	scope:	lt	version:	14.1.0.11	Trust: 1.0
vendor:	siemens	model:	tecnomatix plant simulation	scope:	gte	version:	2302.0	Trust: 1.0
vendor:	siemens	model:	tecnomatix plant simulation	scope:	-	version:	-	Trust: 0.7

sources: ZDI: ZDI-23-1628 // NVD: CVE-2023-38074

CVSS

SEVERITY

CVSSV2

CVSSV3

productcert@siemens.com:	CVE-2023-38074
value:	HIGH
Trust: 1.0
ZDI:	CVE-2023-38074
value:	HIGH
Trust: 0.7

productcert@siemens.com:	CVE-2023-38074
baseSeverity:	HIGH
baseScore:	7.8
vectorString:	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector:	LOCAL
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	REQUIRED
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	1.8
impactScore:	5.9
version:	3.1
Trust: 1.0
ZDI:	CVE-2023-38074
baseSeverity:	HIGH
baseScore:	7.8
vectorString:	AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector:	LOCAL
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	REQUIRED
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	1.8
impactScore:	5.9
version:	3.0
Trust: 0.7

sources: ZDI: ZDI-23-1628 // NVD: CVE-2023-38074

PROBLEMTYPE DATA

problemtype:

CWE-843

Trust: 1.0

sources: NVD: CVE-2023-38074

PATCH

title:

Siemens has issued an update to correct this vulnerability.

url:

https://cert-portal.siemens.com/productcert/html/ssa-278349.html

Trust: 0.7

sources: ZDI: ZDI-23-1628

EXTERNAL IDS

db:	NVD	id:	CVE-2023-38074	Trust: 1.8
db:	SIEMENS	id:	SSA-278349	Trust: 1.1
db:	SIEMENS	id:	SSA-478780	Trust: 1.0
db:	ZDI_CAN	id:	ZDI-CAN-20840	Trust: 0.7
db:	ZDI	id:	ZDI-23-1628	Trust: 0.7
db:	VULMON	id:	CVE-2023-38074	Trust: 0.1

sources: ZDI: ZDI-23-1628 // VULMON: CVE-2023-38074 // NVD: CVE-2023-38074

REFERENCES

url:	https://cert-portal.siemens.com/productcert/pdf/ssa-278349.pdf	Trust: 1.1
url:	https://cert-portal.siemens.com/productcert/pdf/ssa-478780.pdf	Trust: 1.0
url:	https://cert-portal.siemens.com/productcert/html/ssa-278349.html	Trust: 0.7
url:	https://cwe.mitre.org/data/definitions/843.html	Trust: 0.1
url:	https://nvd.nist.gov	Trust: 0.1

sources: ZDI: ZDI-23-1628 // VULMON: CVE-2023-38074 // NVD: CVE-2023-38074

CREDITS

Anonymous

Trust: 0.7

sources: ZDI: ZDI-23-1628

SOURCES

db:	ZDI	id:	ZDI-23-1628
db:	VULMON	id:	CVE-2023-38074
db:	NVD	id:	CVE-2023-38074

LAST UPDATE DATE

2024-08-14T13:13:44.233000+00:00

SOURCES UPDATE DATE

db:	ZDI	id:	ZDI-23-1628	date:	2023-11-14T00:00:00
db:	VULMON	id:	CVE-2023-38074	date:	2023-09-12T00:00:00
db:	NVD	id:	CVE-2023-38074	date:	2024-01-25T02:21:12.227

SOURCES RELEASE DATE

db:	ZDI	id:	ZDI-23-1628	date:	2023-11-14T00:00:00
db:	VULMON	id:	CVE-2023-38074	date:	2023-09-12T00:00:00
db:	NVD	id:	CVE-2023-38074	date:	2023-09-12T10:15:28.367