PT-2023-4226 · Siemens · Solid Edge

CVE-2023-39181 · Publicado 2023-08-08 · Atualizado 2023-08-10

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Solid Edge SE2023 versions prior to V223.0 Update 7

Description A vulnerability has been identified in the affected application, which contains an out of bounds write past the end of an allocated buffer while parsing a specially crafted PAR file. This could allow an attacker to execute code in the context of the current process. The issue is related to a buffer overflow in memory, which can be exploited using specially formed PAR files, potentially allowing an attacker to execute arbitrary code.

Recommendations For Solid Edge SE2023 versions prior to V223.0 Update 7, update to V223.0 Update 7 or later to resolve the issue. As a temporary workaround, consider restricting the use of PAR files from untrusted sources until a patch is applied. Avoid using the affected application to parse specially crafted PAR files until the issue is resolved.

Correção

Memory Corruption

Enumeração de Fraquezas

CWE-787

Identificadores relacionados

BDU:2023-04541

CVE-2023-39181

Produtos afetados

Solid Edge

Referências · 6

• https://cert-portal.siemens.com/productcert/html/ssa-811403.html · Nota
• https://bdu.fstec.ru/vul/2023-04541 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-39181 · Aviso do Fabricante
• https://cert-portal.siemens.com/productcert/pdf/ssa-811403.pdf · Aviso do Fabricante
• https://twitter.com/cracbot/status/1689154689299062785 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2023-39181 · Nota de Segurança