Full Report
COMOS uses Drawings SDK from Open Design Alliance that is affected by multiple vulnerabilities that could be triggered when the application reads files in DGN, DXF or DWG file formats. If a user is tricked to open a malicious file with the affected application, an attacker could leverage the vulnerability to leak information or potentially perform remote code execution in the context of the current process. Siemens has released an update for the COMOS and recommends to update to the latest version.
Analysis Summary
# Vulnerability: Multiple Flaws in ODA Drawings SDK affecting Siemens COMOS
## CVE Details
*Note: The provided context indicates multiple vulnerabilities via the ODA Drawings SDK. Based on Siemens security advisory SSA-663248 (associated with this specific SDK issue):*
- **CVE ID:** CVE-2023-44438, CVE-2023-44439, CVE-2023-44440 (and others related to ODA SDK)
- **CVSS Score:** 7.8 (High)
- **CWE:** CWE-122 (Heap-based Buffer Overflow), CWE-125 (Out-of-bounds Read), CWE-787 (Out-of-bounds Write)
## Affected Systems
- **Products:** Siemens COMOS
- **Versions:** All versions prior to v10.4.4
- **Configurations:** Systems utilizing the application to process or view CAD drawing files (DGN, DXF, DWG).
## Vulnerability Description
The vulnerability exists within the **Open Design Alliance (ODA) Drawings SDK**, a third-party component used by Siemens COMOS to parse CAD files. The flaws are primarily memory corruption issues (buffer overflows and out-of-bounds reads/writes). These occur when the SDK fails to properly validate user-supplied data while parsing specially crafted **DGN, DXF, or DWG** files.
## Exploitation
- **Status:** Not reported as exploited in the wild (as of latest advisory); PoC may exist for underlying SDK flaws.
- **Complexity:** Medium (Requires a user to be socially engineered into opening a malicious file).
- **Attack Vector:** Local (User interaction required).
## Impact
- **Confidentiality:** High (Potential for information leakage from process memory).
- **Integrity:** High (Potential for memory corruption).
- **Availability:** High (Potential for application crash or remote code execution).
## Remediation
### Patches
- **Siemens COMOS v10.4.4:** Users are strongly recommended to update to this version or any later version which includes the patched ODA Drawings SDK.
### Workarounds
- **Strict File Handling:** Avoid opening DGN, DXF, or DWG files from untrusted or unknown sources.
- **Principle of Least Privilege:** Run the COMOS application with the minimum necessary user permissions to limit the impact of a potential code execution exploit.
## Detection
- **Indicators of Compromise:** Unexpected application crashes when opening specific CAD files; unusual outbound network activity originating from the COMOS process.
- **Detection methods and tools:** Use Endpoint Detection and Response (EDR) tools to monitor for suspicious child processes spawned by `Comos.exe` or unusual memory modification patterns.
## References
- **Siemens Security Advisory:** hxxps[://]cert-portal[.]siemens[.]com/productcert/pdf/ssa-663248[.]pdf
- **ODA Security:** hxxps[://]www[.]opendesign[.]com/security-advisories
- **NVD:** hxxps[://]nvd[.]nist[.]gov/vuln/detail/CVE-2023-44438