Full Report
Siemens has released version V13.1.0 for JT2Go and Teamcenter Visualization to fix multiple vulnerabilities that could be triggered when the products read files in different file formats (JT, XML, CG4, CGM, PDF, RGB, SGI, TGA, PAR, PCX). If a user is tricked to opening of a malicious file with the affected products, this could lead to application crash, or potentially arbitrary code execution or data extraction on the target host system. Siemens recommends to update to the latest versions and to limit opening of untrusted files from unknown sources in the affected products. Please refer to SSA-663999 [0] and SSA-695540 [1] for further information regarding later version updates. Note: Previous versions of this advisory also contained the vulnerabilities CVE-2020-26989, CVE-2020-26990, and CVE-2020-28383 (now addressed in [0]) and CVE-2020-26991 (now addressed in [1]). [0] https://cert-portal.siemens.com/productcert/pdf/ssa-663999.pdf [1] https://cert-portal.siemens.com/productcert/pdf/ssa-695540.pdf
Analysis Summary
# Vulnerability: Multiple Memory Corruption Flaws in Siemens JT2Go and Teamcenter Visualization
## CVE Details
*Note: This advisory covers multiple vulnerabilities previously grouped together. The following are specifically identified in the context:*
- **CVE ID:** CVE-2020-26989, CVE-2020-26990, CVE-2020-28383, CVE-2020-26991
- **CVSS Score:** Approximately 7.8 (High) - *Typical for file-parsing arbitrary code execution.*
- **CWE:** CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), CWE-125 (Out-of-bounds Read), CWE-787 (Out-of-bounds Write).
## Affected Systems
- **Products:**
- JT2Go
- Teamcenter Visualization
- **Versions:** All versions prior to V13.1.0.
- **Configurations:** Systems where these applications are associated with parsing 3D/2D CAD and image file formats (JT, XML, CG4, CGM, PDF, RGB, SGI, TGA, PAR, PCX).
## Vulnerability Description
The vulnerabilities exist in the way JT2Go and Teamcenter Visualization parse specifically crafted files in various formats. Due to insufficient validation of user-supplied data, the application may experience memory corruption (such as buffer overflows or out-of-bounds access) when processing malicious files.
## Exploitation
- **Status:** PoC status not explicitly confirmed in the text; assumed "Not exploited in the wild" at time of report.
- **Complexity:** Medium (Requires crafting a specific malicious file).
- **Attack Vector:** Local/User Interaction. An attacker must trick a user into opening a malicious file with the affected software (Social Engineering).
## Impact
- **Confidentiality:** High (Potential for data extraction from the host system).
- **Integrity:** High (Potential for arbitrary code execution).
- **Availability:** High (Application crash/Denial of Service).
## Remediation
### Patches
- **Update to Version V13.1.0 or later:** Siemens has released this version specifically to address these memory corruption vulnerabilities.
- Refer to **SSA-663999** and **SSA-695540** for the most current updates across different product branches.
### Workarounds
- **Strict File Handling:** Limit the opening of untrusted files from unknown or unverified sources.
- **Least Privilege:** Run the applications under a non-privileged user account to reduce the potential impact of code execution.
## Detection
- **Indicators of Compromise:** Unusual application crashes when opening specific file types (JT, PDF, TGA, etc.). Unexpected outbound network traffic or file system changes following a JT2Go crash.
- **Detection Methods:** Use Endpoint Detection and Response (EDR) tools to monitor for suspicious child processes (e.g., cmd.exe or powershell.exe) being spawned by `JT2Go.exe` or Teamcenter Visualization binaries.
## References
- [0] hxxps[://]cert-portal[.]siemens[.]com/productcert/pdf/ssa-663999[.]pdf
- [1] hxxps[://]cert-portal[.]siemens[.]com/productcert/pdf/ssa-695540[.]pdf