Multiple Vulnerabilities in Siemens Solid Edge Visualization Could Lead to Arbitrary Code Execution (ICSA-21-012-04)

ITS Advisory Number: 
2021-010
Date(s) Issued: 
Thursday, January 14, 2021
Subject: 
Multiple Vulnerabilities in Siemens Solid Edge Visualization Could Lead to Arbitrary Code Execution (ICSA-21-012-04)
Overview: 

Multiple vulnerabilities have been discovered in Siemens' JT2Go and Teamcenter Visualization products, the most severe of which could allow for arbitrary code execution in the context of the system process. JT2Go and Teamcenter Visualization are used for viewing 3D models. Depending on the privileges associated with the application, an attacker could view, change, or delete data. If this application has been configured to have fewer user rights on the system, exploitation of the most severe of these vulnerabilities could have less impact than if it was configured with administrative rights.

 

THREAT INTELLIGENCE:

There are currently no reports of these vulnerabilities being exploited in the wild.

Systems Affected: 
  • Solid Edge versions prior to 2021MP2
RISK
GOVERNMENT
Large and medium government entities: 
High
Small government entities: 
Medium
BUSINESS
Large and medium business entities: 
High
Small business entities: 
Medium
Home Users: 
Low
Description: 

Multiple vulnerabilities have been discovered in Siemens' Solid Edge, the most severe of which could allow for arbitrary code execution in the context of the system process. Exploits can be triggered by an unsuspecting user opening a malicious file with the vulnerable software. Details of the vulnerabilities are as follows: 

  • An out-of-bounds write error when parsing 'PAR' files due to a failure to properly validate user input (CVE-2020-28381, CVE-2020-28382, CVE-2020-28383)

  • A stack-based buffer-overflow when parsing 'PAR' files (CVE-2020-28384 and CVE-2020-26989)

  • An out-of-bounds write error when parsing 'DFT' files (CVE-2020-28386) 

Successful exploitation of the most severe of these vulnerabilities could allow an attacker to execute arbitrary code in the context of the browser. Depending on the privileges associated with the application, an attacker could view, change, or delete data. If this application has been configured to have fewer user rights on the system, exploitation of the most severe of these vulnerabilities could have less impact than if it was configured with administrative rights.

Actions: 
  • After appropriate testing, immediately install updated provided by Siemens to the vulnerable systems.

  • Remind users not to visit un-trusted websites or follow links provided by unknown or un-trusted sources.

  • Inform and educate users regarding the threats posed by hypertext links contained in emails or attachments especially from un-trusted sources.

  • Apply the principle of Least Privilege to all systems and services.