Summary
Siemens Teamcenter Visualization and JT2Go are affected by an out of
bounds write vulnerability in APDFL library from Datalogics. If a user
is tricked to open a malicious PDF file with the affected products,
this could lead the application to crash or potentially lead to
arbitrary code execution. Siemens has released updates for the
affected products and recommends to update to the latest versions.
Vulnerabilities 1
-
High 7.8
Datalogics APDFL library Heap-based Buffer Overflow
The APDFL.dll in Siemens JT2Go prior to V13.3.0.5 and Siemens Teamcenter Visualization prior to V14.0.0.2 contains an out of bounds write past the fixed-length heap-based buffer while parsing specially crafted PDF files. This could allow an attacker to execut…
Revision history
-
#2
Added fix for Teamcenter Visualization version line V14.0
-
#1
Publication Date
References
-
SSA-829738: Datalogics File Parsing Vulnerability in Teamcenter Visualization and JT2Go - TXT Version
https://cert-portal.siemens.com/productcert/txt/ssa-829738.txt
-
SSA-829738: Datalogics File Parsing Vulnerability in Teamcenter Visualization and JT2Go - PDF Version
https://cert-portal.siemens.com/productcert/pdf/ssa-829738.pdf
-
ICS Advisory ICSA-22-195-07 - Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-22-195-07
-
Recommended Practices
https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
-
Recommended Practices
https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
-
Recommended Practices
https://www.cisa.gov/topics/industrial-control-systems
-
Recommended Practices
https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
-
Recommended Practices
https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
-
Recommended Practices
https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B