Full Report
Siemens has released version V13.2.0.1 for JT2Go and Teamcenter Visualization to fix multiple vulnerabilities that could be triggered when the products read files in different file formats (CGM, DGN, DXF, and DWG). If a user is tricked to open a malicious file with the affected products, this could lead the application to crash or potentially arbitrary code execution. Siemens recommends to update to the latest versions and to limit opening of untrusted files from unknown sources in the affected products. Note: This advisory also covers security vulnerabilities recently disclosed by Open Design Alliance [0] [0] https://www.opendesign.com/security-advisories
Analysis Summary
# Vulnerability: Multiple Memory Corruption Flaws in Siemens JT2Go and Teamcenter Visualization
## CVE Details
*Note: The provided text refers to a group of vulnerabilities disclosed via the Open Design Alliance (ODA) and Siemens. Common CVEs associated with these ODA library updates often include:*
- **CVE ID:** CVE-2021-27396, CVE-2021-27397, CVE-2021-27398, CVE-2021-27399 (and others associated with SSA-663203)
- **CVSS Score:** 7.8 (High) - *Typical score for this advisory class*
- **CWE:** CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), CWE-125 (Out-of-bounds Read), CWE-787 (Out-of-bounds Write)
## Affected Systems
- **Products:** JT2Go, Teamcenter Visualization
- **Versions:** All versions prior to V13.2.0.1
- **Configurations:** Systems where these applications are used to parse CAD file formats including CGM, DGN, DXF, and DWG.
## Vulnerability Description
The vulnerabilities exist within the file parsing engines used by JT2Go and Teamcenter Visualization. Specifically, the applications inadequately validate input when processing complex CAD file formats (CGM, DGN, DXF, and DWG). A specially crafted file can trigger memory corruption—such as a buffer overflow or an out-of-bounds read/write—when the application attempts to render the malicious content.
## Exploitation
- **Status:** PoC available (General techniques for these ODA-related flaws are known; no reports of widespread exploitation in the wild at time of publication).
- **Complexity:** Medium (Requires crafting specific malicious CAD files).
- **Attack Vector:** Local (User interaction required; the victim must be tricked into opening a malicious file).
## Impact
- **Confidentiality:** High (Potential for arbitrary code execution leading to data theft).
- **Integrity:** High (Potential for arbitrary code execution).
- **Availability:** High (Application crash or system instability).
## Remediation
### Patches
- **Siemens JT2Go:** Update to V13.2.0.1 or later.
- **Teamcenter Visualization:** Update to V13.2.0.1 or later.
### Workarounds
- **Strict File Handling:** Avoid opening CAD files (CGM, DGN, DXF, DWG) received from untrusted or unknown sources.
- **Least Privilege:** Run the applications with the lowest possible user privileges to limit the impact of potential code execution.
## Detection
- **Indicators of Compromise:** Unexpected application crashes when opening specific CAD files; unusual outbound network traffic originating from the `JT2Go.exe` or Teamcenter processes.
- **Detection Methods:** Use EDR (Endpoint Detection and Response) tools to monitor for suspicious child processes spawned by Siemens visualization software.
## References
- **Siemens Security Advisory:** hxxps[://]www[.]siemens[.]com/cert/advisories
- **Open Design Alliance Security:** hxxps[://]www[.]opendesign[.]com/security-advisories
- **CERT/CC Vulnerability Notes:** hxxps[://]www[.]kb[.]cert[.]org/vuls/