Open Design Alliance Drawings SDK (Update A)
Siemens has released version V13.1.0.1 for JT2Go and Teamcenter Visualization to fix multiple vulnerabilities that could be triggered when the products read files in different file formats (BMP, TIFF, CGM, TGA, PCT, HPG, PLT, RAS, PAR, ASM, DXF, DWG). If a user is tricked to opening of a malicious file with the affected products, this could lead to application crash, or potentially arbitrary code execution or data extraction on the target host system. Siemens recommends to update to the latest versions and to limit opening of untrusted files from unknown sources in the affected products. Notes: - Previous versions of this advisory incorrectly listed the following vulnerabilities as being fixed in V13.1.0.1: CVE-2020-26991, CVE-2020-26998, CVE-2020-26999, CVE-2020-27001 and CVE-2020-27002. Those were fixed in V13.1.0.2 and are therefore addressed in advisory SSA-695540 [0] - The vulnerability CVE-2020-28383 was incorrectly listed in SSA-622830 [1] as being fixed in V13.1.0.0. This was fixed in V13.1.0.1 and therefore added here - The Open Design Alliance [2] recently disclosed an additional vulnerability (CVE-2021-31784) which is also covered in this advisory [0] https://cert-portal.siemens.com/productcert/pdf/ssa-622830.pdf [1] https://cert-portal.siemens.com/productcert/pdf/ssa-695540.pdf [2] https://www.opendesign.com/security-advisories
beschreibt (18)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2021-31784US | high7.8 | — | ||
An out-of-bounds write vulnerability exists in the file-reading procedure in Open Design Alliance Drawings SDK before 2021.6 on all supported by ODA platforms in static configurati… | ||||
| CVE-2020-28394US | medium5.5 | — | ||
A vulnerability has been identified in JT2Go (All versions < V13.1.0.1), Teamcenter Visualization (All versions < V13.1.0.1). Affected applications lack proper validation of user-s… | ||||
| CVE-2020-27008US | medium5.5 | — | ||
A vulnerability has been identified in JT2Go (All versions < V13.1.0.1), Teamcenter Visualization (All versions < V13.1.0.1). Affected applications lack proper validation of user-s… | ||||
| CVE-2020-27007US | medium5.5 | — | ||
A vulnerability has been identified in JT2Go (All versions < V13.1.0.1), Teamcenter Visualization (All versions < V13.1.0.1). Affected applications lack proper validation of user-s… | ||||
| CVE-2020-27006US | high7.8 | — | ||
A vulnerability has been identified in JT2Go (All versions < V13.1.0.1), Teamcenter Visualization (All versions < V13.1.0.1). Affected applications lack proper validation of user-s… | ||||
| CVE-2020-27005US | high7.8 | — | ||
A vulnerability has been identified in JT2Go (All versions < V13.1.0.1), Teamcenter Visualization (All versions < V13.1.0.1). Affected applications lack proper validation of user-s… | ||||
| CVE-2020-27004US | medium5.5 | — | ||
A vulnerability has been identified in JT2Go (All versions < V13.1.0.1), Teamcenter Visualization (All versions < V13.1.0.1). Affected applications lack proper validation of user-s… | ||||
| CVE-2020-27003US | high7.8 | — | ||
A vulnerability has been identified in JT2Go (All versions < V13.1.0.1), Teamcenter Visualization (All versions < V13.1.0.1). Affected applications lack proper validation of user-s… | ||||
| CVE-2020-27000US | high7.8 | — | ||
A vulnerability has been identified in JT2Go (All versions < V13.1.0.1), Teamcenter Visualization (All versions < V13.1.0.1). Affected applications lack proper validation of user-s… | ||||
| CVE-2021-25178US | high7.8 | — | ||
An issue was discovered in Open Design Alliance Drawings SDK before 2021.11. A stack-based buffer overflow vulnerability exists when the recover operation is run with malformed .DX… | ||||
| CVE-2021-25177US | high7.8 | — | ||
An issue was discovered in Open Design Alliance Drawings SDK before 2021.11. A Type Confusion issue exists when rendering malformed .DXF and .DWG files. This can allow attackers to… | ||||
| CVE-2021-25176US | high7.8 | — | ||
An issue was discovered in Open Design Alliance Drawings SDK before 2021.11. A NULL pointer dereference exists when rendering malformed .DXF and .DWG files. This can allow attacker… | ||||
| CVE-2021-25175US | high7.8 | — | ||
An issue was discovered in Open Design Alliance Drawings SDK before 2021.11. A Type Conversion issue exists when rendering malformed .DXF and .DWG files. This can allow attackers t… | ||||
| CVE-2021-25174US | high7.8 | — | ||
An issue was discovered in Open Design Alliance Drawings SDK before 2021.12. A memory corruption vulnerability exists when reading malformed DGN files. It can allow attackers to ca… | ||||
| CVE-2021-25173US | high7.8 | — | ||
An issue was discovered in Open Design Alliance Drawings SDK before 2021.12. A memory allocation with excessive size vulnerability exists when reading malformed DGN files, which al… | ||||
| CVE-2020-28383US | high7.8 | — | ||
A vulnerability has been identified in JT2Go (All versions < V13.1.0.1), Solid Edge SE2020 (All Versions < SE2020MP12), Solid Edge SE2021 (All Versions < SE2021MP2), Teamcenter Vis… | ||||
| CVE-2020-26990US | high8.8 | — | ||
A vulnerability has been identified in JT2Go (All versions < V13.1.0.1), Teamcenter Visualization (All versions < V13.1.0.1). Affected applications lack proper validation of user-s… | ||||
| CVE-2020-26989US | high7.8 | — | ||
A vulnerability has been identified in JT2Go (All versions < V13.1.0.1), Solid Edge SE2020 (All Versions < SE2020MP12), Solid Edge SE2021 (All Versions < SE2021MP2), Teamcenter Vis… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- SSA-663999: Multiple File Parsing Vulnerabilities in JT2Go and Teamcenter Visualization before V13.1.0.1 - CSAF Versionself
- SSA-663999: Multiple File Parsing Vulnerabilities in JT2Go and Teamcenter Visualization before V13.1.0.1 - PDF Versionself
- SSA-663999: Multiple File Parsing Vulnerabilities in JT2Go and Teamcenter Visualization before V13.1.0.1 - TXT Versionself
- ICS Advisory ICSA-21-047-01 JSONself
- Recommended Practicesexternal
- ICS Advisory ICSA-21-047-01 - Web Versionself
- Recommended Practicesexternal
- Recommended Practicesexternal
Behebungen (72)
- MitigationJT2Go
Avoid to open untrusted files from unknown sources in JT2Go and Teamcenter Visualization
- MitigationJT2Go
Avoid to open untrusted files from unknown sources in JT2Go and Teamcenter Visualization
- MitigationJT2Go
Avoid to open untrusted files from unknown sources in JT2Go and Teamcenter Visualization
- MitigationJT2Go
Avoid to open untrusted files from unknown sources in JT2Go and Teamcenter Visualization
- MitigationJT2Go
Avoid to open untrusted files from unknown sources in JT2Go and Teamcenter Visualization
- MitigationJT2Go
Avoid to open untrusted files from unknown sources in JT2Go and Teamcenter Visualization
- MitigationJT2Go
Avoid to open untrusted files from unknown sources in JT2Go and Teamcenter Visualization
- MitigationJT2Go
Avoid to open untrusted files from unknown sources in JT2Go and Teamcenter Visualization
- MitigationJT2Go
Avoid to open untrusted files from unknown sources in JT2Go and Teamcenter Visualization
- MitigationJT2Go
Avoid to open untrusted files from unknown sources in JT2Go and Teamcenter Visualization
- MitigationJT2Go
Avoid to open untrusted files from unknown sources in JT2Go and Teamcenter Visualization
- MitigationJT2Go
Avoid to open untrusted files from unknown sources in JT2Go and Teamcenter Visualization
- MitigationJT2Go
Avoid to open untrusted files from unknown sources in JT2Go and Teamcenter Visualization
- MitigationJT2Go
Avoid to open untrusted files from unknown sources in JT2Go and Teamcenter Visualization
- MitigationJT2Go
Avoid to open untrusted files from unknown sources in JT2Go and Teamcenter Visualization
- MitigationJT2Go
Avoid to open untrusted files from unknown sources in JT2Go and Teamcenter Visualization
- MitigationJT2Go
Avoid to open untrusted files from unknown sources in JT2Go and Teamcenter Visualization
- MitigationJT2Go
Avoid to open untrusted files from unknown sources in JT2Go and Teamcenter Visualization
- MitigationTeamcenter Visualization
Avoid to open untrusted files from unknown sources in JT2Go and Teamcenter Visualization
- MitigationTeamcenter Visualization
Avoid to open untrusted files from unknown sources in JT2Go and Teamcenter Visualization
- MitigationTeamcenter Visualization
Avoid to open untrusted files from unknown sources in JT2Go and Teamcenter Visualization
- MitigationTeamcenter Visualization
Avoid to open untrusted files from unknown sources in JT2Go and Teamcenter Visualization
- MitigationTeamcenter Visualization
Avoid to open untrusted files from unknown sources in JT2Go and Teamcenter Visualization
- MitigationTeamcenter Visualization
Avoid to open untrusted files from unknown sources in JT2Go and Teamcenter Visualization
- MitigationTeamcenter Visualization
Avoid to open untrusted files from unknown sources in JT2Go and Teamcenter Visualization
- MitigationTeamcenter Visualization
Avoid to open untrusted files from unknown sources in JT2Go and Teamcenter Visualization
- MitigationTeamcenter Visualization
Avoid to open untrusted files from unknown sources in JT2Go and Teamcenter Visualization
- MitigationTeamcenter Visualization
Avoid to open untrusted files from unknown sources in JT2Go and Teamcenter Visualization
- MitigationTeamcenter Visualization
Avoid to open untrusted files from unknown sources in JT2Go and Teamcenter Visualization
- MitigationTeamcenter Visualization
Avoid to open untrusted files from unknown sources in JT2Go and Teamcenter Visualization
- MitigationTeamcenter Visualization
Avoid to open untrusted files from unknown sources in JT2Go and Teamcenter Visualization
- MitigationTeamcenter Visualization
Avoid to open untrusted files from unknown sources in JT2Go and Teamcenter Visualization
- MitigationTeamcenter Visualization
Avoid to open untrusted files from unknown sources in JT2Go and Teamcenter Visualization
- MitigationTeamcenter Visualization
Avoid to open untrusted files from unknown sources in JT2Go and Teamcenter Visualization
- MitigationTeamcenter Visualization
Avoid to open untrusted files from unknown sources in JT2Go and Teamcenter Visualization
- MitigationTeamcenter Visualization
Avoid to open untrusted files from unknown sources in JT2Go and Teamcenter Visualization
- BehobenJT2Go
Update to V13.1.0.1 or later version
https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html - BehobenJT2Go
Update to V13.1.0.1 or later version
https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html - BehobenJT2Go
Update to V13.1.0.1 or later version
https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html - BehobenJT2Go
Update to V13.1.0.1 or later version
https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html - BehobenJT2Go
Update to V13.1.0.1 or later version
https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html - BehobenJT2Go
Update to V13.1.0.1 or later version
https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html - BehobenJT2Go
Update to V13.1.0.1 or later version
https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html - BehobenJT2Go
Update to V13.1.0.1 or later version
https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html - BehobenJT2Go
Update to V13.1.0.1 or later version
https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html - BehobenJT2Go
Update to V13.1.0.1 or later version
https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html - BehobenJT2Go
Update to V13.1.0.1 or later version
https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html - BehobenJT2Go
Update to V13.1.0.1 or later version
https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html - BehobenJT2Go
Update to V13.1.0.1 or later version
https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html - BehobenJT2Go
Update to V13.1.0.1 or later version
https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html - BehobenJT2Go
Update to V13.1.0.1 or later version
https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html - BehobenJT2Go
Update to V13.1.0.1 or later version
https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html - BehobenJT2Go
Update to V13.1.0.1 or later version
https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html - BehobenJT2Go
Update to V13.1.0.1 or later version
https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html - BehobenTeamcenter Visualization
Update to V13.1.0.1 or later version
- BehobenTeamcenter Visualization
Update to V13.1.0.1 or later version
- BehobenTeamcenter Visualization
Update to V13.1.0.1 or later version
- BehobenTeamcenter Visualization
Update to V13.1.0.1 or later version
- BehobenTeamcenter Visualization
Update to V13.1.0.1 or later version
- BehobenTeamcenter Visualization
Update to V13.1.0.1 or later version
- BehobenTeamcenter Visualization
Update to V13.1.0.1 or later version
- BehobenTeamcenter Visualization
Update to V13.1.0.1 or later version
- BehobenTeamcenter Visualization
Update to V13.1.0.1 or later version
- BehobenTeamcenter Visualization
Update to V13.1.0.1 or later version
- BehobenTeamcenter Visualization
Update to V13.1.0.1 or later version
- BehobenTeamcenter Visualization
Update to V13.1.0.1 or later version
- BehobenTeamcenter Visualization
Update to V13.1.0.1 or later version
- BehobenTeamcenter Visualization
Update to V13.1.0.1 or later version
- BehobenTeamcenter Visualization
Update to V13.1.0.1 or later version
- BehobenTeamcenter Visualization
Update to V13.1.0.1 or later version
- BehobenTeamcenter Visualization
Update to V13.1.0.1 or later version
- BehobenTeamcenter Visualization
Update to V13.1.0.1 or later version
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan