Siemens JT2Go/Teamcenter Visualization RAS File CCITT_G4Decode.dll out-of-bounds

Summaryinfo

A vulnerability has been found in Siemens JT2Go and Teamcenter Visualization and classified as problematic. This affects an unknown part in the library CCITT_G4Decode.dll of the component RAS File Handler. Performing a manipulation results in out-of-bounds. This vulnerability is reported as CVE-2022-45484. The attack is possible to be carried out remotely. No exploit exists. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in Siemens JT2Go and Teamcenter Visualization (the affected version unknown). It has been classified as critical. This affects an unknown part in the library CCITT_G4Decode.dll of the component RAS File Handler. The manipulation with an unknown input leads to a out-of-bounds vulnerability. CWE is classifying the issue as CWE-125. The product reads data past the end, or before the beginning, of the intended buffer. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

A vulnerability has been identified in JT2Go (All versions), Teamcenter Visualization V13.2 (All versions < V13.2.0.12), Teamcenter Visualization V13.3 (All versions < V13.3.0.8), Teamcenter Visualization V13.3 (All versions >= V13.3.0.8), Teamcenter Visualization V14.0 (All versions < V14.0.0.4), Teamcenter Visualization V14.0 (All versions >= V14.0.0.4), Teamcenter Visualization V14.1 (All versions < V14.1.0.6). The CCITT_G4Decode.dll contains an out of bounds read vulnerability when parsing a RAS file. An attacker can leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-19056)

The weakness was disclosed 12/13/2022 as ssa-700053. It is possible to read the advisory at cert-portal.siemens.com. This vulnerability is uniquely identified as CVE-2022-45484 since 11/21/2022. It demands that the victim is doing some kind of user interaction. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Image Processing Software

Vendor

• Siemens

Name

• JT2Go
• Teamcenter Visualization

License

• commercial

Website

• Vendor: https://www.siemens.com/

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion