Details of VAR-202309-0579

ID

VAR-202309-0579

CVE

CVE-2023-38072

TITLE

Siemens Tecnomatix Plant Simulation WRL File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

Trust: 0.7

sources: ZDI: ZDI-23-1630

DESCRIPTION

A vulnerability has been identified in JT2Go (All versions < V14.3.0.1), Teamcenter Visualization V13.3 (All versions < V13.3.0.12), Teamcenter Visualization V14.0 (All versions), Teamcenter Visualization V14.1 (All versions < V14.1.0.11), Teamcenter Visualization V14.2 (All versions < V14.2.0.6), Teamcenter Visualization V14.3 (All versions < V14.3.0.1), Tecnomatix Plant Simulation V2201 (All versions < V2201.0010), Tecnomatix Plant Simulation V2302 (All versions < V2302.0004). The affected application contains an out of bounds write past the end of an allocated structure while parsing specially crafted WRL files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-20825). This vulnerability allows remote attackers to execute arbitrary code on affected installations of Siemens Tecnomatix Plant Simulation. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the parsing of WRL files

Trust: 1.62

sources: NVD: CVE-2023-38072 // ZDI: ZDI-23-1630 // VULMON: CVE-2023-38072

AFFECTED PRODUCTS

vendor:	siemens	model:	teamcenter visualization	scope:	gte	version:	14.0	Trust: 1.0
vendor:	siemens	model:	tecnomatix plant simulation	scope:	gte	version:	2201.0	Trust: 1.0
vendor:	siemens	model:	teamcenter visualization	scope:	lt	version:	14.2.0.6	Trust: 1.0
vendor:	siemens	model:	teamcenter visualization	scope:	lt	version:	14.3.0.1	Trust: 1.0
vendor:	siemens	model:	teamcenter visualization	scope:	lt	version:	13.4.0.12	Trust: 1.0
vendor:	siemens	model:	teamcenter visualization	scope:	lt	version:	14.1.0.11	Trust: 1.0
vendor:	siemens	model:	teamcenter visualization	scope:	gte	version:	13.3.0	Trust: 1.0
vendor:	siemens	model:	jt2go	scope:	lt	version:	14.3.0.1	Trust: 1.0
vendor:	siemens	model:	tecnomatix plant simulation	scope:	gte	version:	2302.0	Trust: 1.0
vendor:	siemens	model:	teamcenter visualization	scope:	gte	version:	14.2	Trust: 1.0
vendor:	siemens	model:	teamcenter visualization	scope:	gte	version:	14.3	Trust: 1.0
vendor:	siemens	model:	tecnomatix plant simulation	scope:	lt	version:	2201.0010	Trust: 1.0
vendor:	siemens	model:	tecnomatix plant simulation	scope:	lt	version:	2302.0004	Trust: 1.0
vendor:	siemens	model:	tecnomatix plant simulation	scope:	-	version:	-	Trust: 0.7

sources: ZDI: ZDI-23-1630 // NVD: CVE-2023-38072

CVSS

SEVERITY

CVSSV2

CVSSV3

productcert@siemens.com:	CVE-2023-38072
value:	HIGH
Trust: 1.0
ZDI:	CVE-2023-38072
value:	HIGH
Trust: 0.7

productcert@siemens.com:	CVE-2023-38072
baseSeverity:	HIGH
baseScore:	7.8
vectorString:	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector:	LOCAL
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	REQUIRED
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	1.8
impactScore:	5.9
version:	3.1
Trust: 1.0
ZDI:	CVE-2023-38072
baseSeverity:	HIGH
baseScore:	7.8
vectorString:	AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector:	LOCAL
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	REQUIRED
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	1.8
impactScore:	5.9
version:	3.0
Trust: 0.7

sources: ZDI: ZDI-23-1630 // NVD: CVE-2023-38072

PROBLEMTYPE DATA

problemtype:

CWE-787

Trust: 1.0

sources: NVD: CVE-2023-38072

PATCH

title:

Siemens has issued an update to correct this vulnerability.

url:

https://cert-portal.siemens.com/productcert/html/ssa-278349.html

Trust: 0.7

sources: ZDI: ZDI-23-1630

EXTERNAL IDS

db:	NVD	id:	CVE-2023-38072	Trust: 1.8
db:	SIEMENS	id:	SSA-278349	Trust: 1.1
db:	SIEMENS	id:	SSA-478780	Trust: 1.0
db:	ZDI_CAN	id:	ZDI-CAN-20825	Trust: 0.7
db:	ZDI	id:	ZDI-23-1630	Trust: 0.7
db:	VULMON	id:	CVE-2023-38072	Trust: 0.1

sources: ZDI: ZDI-23-1630 // VULMON: CVE-2023-38072 // NVD: CVE-2023-38072

REFERENCES

url:	https://cert-portal.siemens.com/productcert/pdf/ssa-278349.pdf	Trust: 1.1
url:	https://cert-portal.siemens.com/productcert/pdf/ssa-478780.pdf	Trust: 1.0
url:	https://cert-portal.siemens.com/productcert/html/ssa-278349.html	Trust: 0.7
url:	https://cwe.mitre.org/data/definitions/787.html	Trust: 0.1
url:	https://nvd.nist.gov	Trust: 0.1

sources: ZDI: ZDI-23-1630 // VULMON: CVE-2023-38072 // NVD: CVE-2023-38072

CREDITS

Anonymous

Trust: 0.7

sources: ZDI: ZDI-23-1630

SOURCES

db:	ZDI	id:	ZDI-23-1630
db:	VULMON	id:	CVE-2023-38072
db:	NVD	id:	CVE-2023-38072

LAST UPDATE DATE

2024-08-14T12:19:45.359000+00:00

SOURCES UPDATE DATE

db:	ZDI	id:	ZDI-23-1630	date:	2023-11-14T00:00:00
db:	VULMON	id:	CVE-2023-38072	date:	2023-09-12T00:00:00
db:	NVD	id:	CVE-2023-38072	date:	2024-02-16T15:08:06.607

SOURCES RELEASE DATE

db:	ZDI	id:	ZDI-23-1630	date:	2023-11-14T00:00:00
db:	VULMON	id:	CVE-2023-38072	date:	2023-09-12T00:00:00
db:	NVD	id:	CVE-2023-38072	date:	2023-09-12T10:15:27.863