Summary
Siemens has released version V13.0.2.0 for JT Utilities to fix multiple vulnerabilities that could be triggered when reading JT files.
Siemens recommends to update to the latest version, which contains solutions to all the vulnerabilities listed in this advisory. Standing recommendation is to avoid opening of untrusted files from unknown sources in the affected product, as this generally mitigates the risk of exploitation of this class of vulnerabilities for any product release.
Vulnerabilities 3
-
Unscored —
A vulnerability has been identified in JT Utilities (All versions < V13.0.2.0). When parsing specially crafted JT files…
-
Unscored —
A vulnerability has been identified in JT Utilities (All versions < V13.0.2.0). When parsing specially crafted JT files…
-
Unscored —
A vulnerability has been identified in JT Utilities (All versions < V13.0.2.0). When parsing specially crafted JT files…
Revision history
-
#2
Revision - Fixing typos
-
#1
Publication Date
References
-
SSA-209268: Multiple JT File Parsing Vulnerabilities in JT Utilities before V13.0.2.0 - TXT Version
https://cert-portal.siemens.com/productcert/txt/ssa-209268.txt
-
SSA-209268: Multiple JT File Parsing Vulnerabilities in JT Utilities before V13.0.2.0 - PDF Version
https://cert-portal.siemens.com/productcert/pdf/ssa-209268.pdf
-
ICS Advisory ICSA-21-194-09 - Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-21-194-09
-
Recommended Practices
https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
-
Recommended Practices
https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
-
Recommended Practices
https://www.cisa.gov/topics/industrial-control-systems
-
Recommended Practices
https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
-
Recommended Practices
https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
-
Recommended Practices
https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B