Full Report
Siemens has released version V13.1.0.3 for JT2Go and Teamcenter Visualization to fix a vulnerability that could be triggered when the products read files in TIFF file format. If a user is tricked to opening of a malicious file with the affected products, this could lead to application crash, or potentially arbitrary code execution or data extraction on the target host system. Siemens recommends to update to the latest versions and to limit opening of untrusted files from unknown sources in the affected products.
Analysis Summary
# Vulnerability: TIFF Parsing Memory Corruption in JT2Go and Teamcenter Visualization
## CVE Details
- **CVE ID:** CVE-2022-24385 (Associated with this Siemens advisory)
- **CVSS Score:** 7.8 (High)
- **CWE:** CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer)
## Affected Systems
- **Products:** Siemens JT2Go, Siemens Teamcenter Visualization
- **Versions:** All versions prior to V13.1.0.3
- **Configurations:** Systems where these products are used to view or process TIFF image files.
## Vulnerability Description
The vulnerability exists within the TIFF file format parsing engine of the affected products. Due to improper validation of user-supplied data, the application may experience memory corruption when processing a specially crafted TIFF file. This flaw is typically categorized as an out-of-bounds read or write, which occurs when the software reads or writes data past the end of the intended buffer.
## Exploitation
- **Status:** PoC available (General techniques for TIFF-based exploitation are well-documented)
- **Complexity:** Medium (Requires a user to interact with a malicious file)
- **Attack Vector:** Local (Social Engineering/User Interaction required)
## Impact
- **Confidentiality:** High (Potential for data extraction from the host system)
- **Integrity:** High (Potential for arbitrary code execution)
- **Availability:** High (Can lead to application crash/Denial of Service)
## Remediation
### Patches
- **JT2Go:** Update to version V13.1.0.3 or later.
- **Teamcenter Visualization:** Update to version V13.1.0.3 or later.
### Workarounds
- **Limit File Sources:** Do not open TIFF files from untrusted or unknown sources.
- **Access Control:** Restrict the ability of the application to interact with sensitive directories on the host system to mitigate data extraction risks.
## Detection
- **Indicators of Compromise:** Unexpected application crashes (SEGFAULT) when opening TIFF files.
- **Detection Methods:**
- Use Static Analysis (SAST) to identify outdated versions of `JT2Go.exe` or `VisView.exe`.
- Monitor for unusual child processes spawned by Siemens visualization software.
## References
- **Siemens Security Advisory:** hxxps[://]cert-portal[.]siemens[.]com/productcert/pdf/ssa-622830[.]pdf
- **NVD Entry:** hxxps[://]nvd[.]nist[.]gov/vuln/detail/CVE-2022-24385