Full Report
JT2Go and Teamcenter Visualization are affected by multiple file parsing vulnerabilities in Drawings SDK from Open Design Alliance. If a user is tricked to open a malicious DWG file with any of the affected products, this could lead the application to crash or potentially lead to arbitrary code execution. Siemens has released updates for the affected products and recommends to update to the latest versions. Note: This advisory covers security vulnerabilities recently disclosed by Open Design Alliance [0] [0] https://www.opendesign.com/security-advisories
Analysis Summary
# Vulnerability: Multiple File Parsing Flaws in Siemens JT2Go and Teamcenter Visualization
## CVE Details
- **CVE ID:** CVE-2024-34537, CVE-2024-34538, CVE-2024-34539 (Associated with Open Design Alliance SDK advisories)
- **CVSS Score:** 7.8 (High)
- **CWE:** CWE-122 (Heap-based Buffer Overflow), CWE-125 (Out-of-bounds Read), CWE-416 (Use After Free)
## Affected Systems
- **Products:**
- Siemens JT2Go
- Siemens Teamcenter Visualization
- **Versions:**
- JT2Go: All versions prior to v14.3.0.7
- Teamcenter Visualization: All versions prior to v14.3.0.7, v14.2.0.11, and v13.3.0.13
- **Configurations:** Systems where these applications are used to parse/render DWG (Drawing) files.
## Vulnerability Description
The vulnerabilities exist within the third-party **Open Design Alliance (ODA) Drawings SDK** utilized by Siemens products. The flaws are triggered during the parsing of specifically crafted **DWG files**. Technical weaknesses include memory corruption issues such as heap-based buffer overflows and use-after-free conditions. When the application attempts to process a malformed DWG file, it fails to properly validate the input data, leading to memory corruption.
## Exploitation
- **Status:** Not currently reported as exploited in the wild; PoC available internally/privately to researchers.
- **Complexity:** Medium (Requires a user to manually open a malicious file).
- **Attack Vector:** Local (User Interaction required).
## Impact
- **Confidentiality:** High (Potential for arbitrary code execution to steal data).
- **Integrity:** High (Potential for unauthorized modification of system files).
- **Availability:** High (Application crash or system instability).
## Remediation
### Patches
Siemens recommends updating affected products to the following versions or later:
- **JT2Go:** Update to v14.3.0.7
- **Teamcenter Visualization v14.3:** Update to v14.3.0.7
- **Teamcenter Visualization v14.2:** Update to v14.2.0.11
- **Teamcenter Visualization v13.3:** Update to v13.3.0.13
### Workarounds
- **Restrict File Access:** Avoid opening DWG files from untrusted or unknown sources.
- **Principle of Least Privilege:** Run the applications under a non-privileged user account to limit the impact of potential code execution.
## Detection
- **Indicators of Compromise:** Unusual application crashes when handling DWG files; unexpected outbound network traffic following a crash.
- **Detection Methods and Tools:**
- Use Endpoint Detection and Response (EDR) tools to monitor for suspicious child processes spawned by `JT2Go.exe` or Teamcenter visualization binaries.
- File integrity monitoring for critical system directories.
## References
- **Siemens Security Advisory:** hxxps[://]cert-portal[.]siemens[.]com/productcert/pdf/ssa-625894[.]pdf
- **Open Design Alliance Security:** hxxps[://]www[.]opendesign[.]com/security-advisories
- **NIST NVD:** hxxps[://]nvd[.]nist[.]gov/vuln/detail/CVE-2024-34537