PT-2023-4019 · Siemens · Tecnomatix Plant Simulation

CVE-2023-37247 · Publicado 2023-06-29 · Atualizado 2023-10-11

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Tecnomatix Plant Simulation versions prior to V2201.0008 Tecnomatix Plant Simulation versions prior to V2302.0002

Description The issue is related to a heap-based buffer overflow that occurs when the application parses specially crafted PAR files. This could allow an attacker to execute code in the context of the current process.

Recommendations For versions prior to V2201.0008, update to version V2201.0008 or later. For versions prior to V2302.0002, update to version V2302.0002 or later. As a temporary workaround, consider restricting the processing of PAR files until a patch is available.

Correção

Memory Corruption

Heap Based Buffer Overflow

Enumeração de Fraquezas

CWE-787

CWE-122

Identificadores relacionados

BDU:2023-04317

CVE-2023-37247

ZDI-23-1556

Produtos afetados

Tecnomatix Plant Simulation

Referências · 7

• https://osv.dev/vulnerability/CVE-2023-37247 · Aviso do Fabricante
• https://t.me/cibsecurity/66342 · Publicação no Telegram
• https://bdu.fstec.ru/vul/2023-04317 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2023-37247 · Nota de Segurança
• https://cert-portal.siemens.com/productcert/pdf/ssa-764801.pdf · Aviso do Fabricante
• https://safe-surf.ru/specialists/bulletins-nkcki/696305 · Nota de Segurança
• https://zerodayinitiative.com/advisories/ZDI-23-1556 · Nota de Segurança