PT-2023-3247 · Siemens · Tecnomatix Plant Simulation

Publicado 2023-02-14 · Atualizado 2023-02-24 · CVE-2023-24978

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Tecnomatix Plant Simulation versions prior to V2201.0006

Description The issue is related to access to an uninitialized pointer in the Tecnomatix Plant Simulation software. This can be exploited by an attacker using a specially crafted SPP file, allowing them to execute arbitrary code in the context of the current process.

Recommendations For versions prior to V2201.0006, update to version V2201.0006 or later to resolve the issue. As a temporary workaround, consider restricting access to SPP files or avoiding the use of specially crafted SPP files until the issue is resolved.

Correção

Access of Uninitialized Pointer

Enumeração de Fraquezas

CWE-824

Identificadores relacionados

BDU:2023-03368

CVE-2023-24978

ZDI-23-186

Produtos afetados

Tecnomatix Plant Simulation

Referências · 6

• https://osv.dev/vulnerability/CVE-2023-24978 · Aviso do Fabricante
• https://vuldb.com/ru/?id.220893 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-24978 · Nota de Segurança
• https://zerodayinitiative.com/advisories/ZDI-23-186 · Nota de Segurança
• https://bdu.fstec.ru/vul/2023-03368 · Nota de Segurança
• https://cert-portal.siemens.com/productcert/pdf/ssa-847261.pdf · Aviso do Fabricante