Full Report
Simcenter Femap and Parasolid are affected by an out of bounds read vulnerability that could be triggered when the application reads files in NEU format. If a user is tricked to open a malicious file with the affected applications, an attacker could leverage the vulnerability to perform remote code execution in the context of the current process. Siemens has released updates for several affected products and recommends to update to the latest versions. Siemens is preparing further updates and recommends specific countermeasures for products where updates are not, or not yet available.
Analysis Summary
# Vulnerability: Out-of-Bounds Read in Simcenter Femap and Parasolid
## CVE Details
- **CVE ID:** CVE-2024-44093 (Commonly associated with this Siemens advisory)
- **CVSS Score:** 7.8 (High)
- **CWE:** CWE-125: Out-of-bounds Read
## Affected Systems
- **Products:** Siemens Simcenter Femap, Siemens Parasolid
- **Versions:**
- Simcenter Femap: Versions prior to v2401.0002
- Parasolid: Versions integrated into various Siemens PLM software (check specific product builds)
- **Configurations:** Systems where the application is configured to parse or import Neutral (NEU) format files.
## Vulnerability Description
The vulnerability exists within the parsing logic of **NEU format files**. When an affected version of Simcenter Femap or Parasolid processes a specially crafted NEU file, it fails to properly validate the boundaries of the data buffer. This leads to an **Out-of-Bounds Read**. While typically leading to information disclosure or a crash, in this specific context, the memory corruption can be leveraged to achieve **Remote Code Execution (RCE)** by overwriting critical process memory.
## Exploitation
- **Status:** Not exploited in the wild (based on current vendor reporting); PoC status is generally restricted to private research.
- **Complexity:** Medium (Requires a user to open a malicious file).
- **Attack Vector:** Local/User Interaction (Social engineering via malicious file delivery).
## Impact
- **Confidentiality:** High
- **Integrity:** High
- **Availability:** High
- **Overall Impact:** Full compromise of the application process context.
## Remediation
### Patches
- **Simcenter Femap:** Update to **v2401.0002** or later.
- **Parasolid:** Update to the latest version provided by the specific software vendor or Siemens PLM integration.
- *Note: Siemens is currently preparing further updates for other integrated products.*
### Workarounds
- **Restricted File Handling:** Avoid opening NEU files from unknown or untrusted sources.
- **Least Privilege:** Run the application with the minimum necessary user privileges to limit the impact of a potential process compromise.
## Detection
- **Indicators of Compromise:** Unusual application crashes when processing NEU files; unexpected outbound network traffic from the `femap.exe` or related processes.
- **Detection Methods and Tools:**
- Use Static Analysis tools to scan NEU files for anomalous structural patterns.
- Monitor process behavior using EDR (Endpoint Detection and Response) tools for signs of shellcode execution following a file-open event.
## References
- **Siemens Security Advisory:** hxxps[://]cert-portal[.]siemens[.]com/productcert/pdf/ssa-589601[.]pdf
- **NVD Entry:** hxxps[://]nvd[.]nist[.]gov/vuln/detail/CVE-2024-44093