Summary
Simcenter Nastran is affected by a stack overflow vulnerability that could be triggered when an application binary reads arbitrary string as a file argument. If a user is tricked to run one of the impacted application binary with a malicious string, an attacker could leverage the vulnerability to perform remote code execution in the context of the current process.
Siemens has released new versions for the affected products and recommends to update to the latest versions.
Vulnerabilities 1
-
High 7.8
A vulnerability has been identified in Simcenter Femap (All versions < V2606), Simcenter Nastran (All versions < V2606)…
Revision history
-
#3
Initial CISA Republication of Siemens ProductCERT SSA-069220 advisory
-
#2
Added Simcenter Femap with fix
-
#1
Publication Date
References
-
SSA-069220: Stack Overflow Vulnerability in Simcenter Nastran Before V2606 - HTML Version
https://cert-portal.siemens.com/productcert/html/ssa-069220.html
-
ICS Advisory ICSA-26-230-02 - Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-26-230-02
-
Recommended Practices
https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01
-
Recommended Practices
https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
-
Recommended Practices
https://www.cisa.gov/topics/industrial-control-systems
-
Recommended Practices
https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
-
Recommended Practices
https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
-
Recommended Practices
https://www.cisa.gov/news-events/news/targeted-cyber-intrusion-detection-and-mitigation-strategies-update-b