A vulnerability was found in Siemens Teamcenter Visualization and JT2Go (version unknown). It has been classified as critical. This affects an unknown function of the component WRL File Handler. The manipulation with an unknown input leads to a out-of-bounds write vulnerability. CWE is classifying the issue as CWE-787. The product writes data past the end, or before the beginning, of the intended buffer. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

A vulnerability has been identified in JT2Go (All versions < V14.3.0.1), Teamcenter Visualization V13.3 (All versions < V13.3.0.12), Teamcenter Visualization V14.0 (All versions), Teamcenter Visualization V14.1 (All versions < V14.1.0.11), Teamcenter Visualization V14.2 (All versions < V14.2.0.6), Teamcenter Visualization V14.3 (All versions < V14.3.0.1). The affected application contains an out of bounds write past the end of an allocated structure while parsing specially crafted WRL files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-20825)

The weakness was published 09/12/2023 as ssa-278349. The advisory is shared at cert-portal.siemens.com. This vulnerability is uniquely identified as CVE-2023-38072 since 07/12/2023. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 09/12/2023).

Upgrading eliminates this vulnerability.

Similar entries are available at VDB-239503, VDB-239504, VDB-239506 and VDB-239507.

Productinfo

Vendor

• Siemens

Name

• JT2Go
• Teamcenter Visualization

License

• commercial

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion