PT-2021-17430 · Siemens · Simcenter Femap

Francis Provencher · Published 2021-06-08 · Updated 2021-12-02 · CVE-2021-27387

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Simcenter Femap versions prior to 2020.2.MP3 Simcenter Femap versions prior to 2021.1.MP3

Description A vulnerability has been identified in the femap.exe application, which lacks proper validation of user-supplied data when parsing FEMAP files. This could result in an out of bounds write past the end of an allocated structure. An attacker could leverage this vulnerability to execute code in the context of the current process.

Recommendations For Simcenter Femap versions prior to 2020.2.MP3, update to version 2020.2.MP3 or later. For Simcenter Femap versions prior to 2021.1.MP3, update to version 2021.1.MP3 or later.

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2021-27387

ZDI-21-780

Affected Products

Simcenter Femap

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2021-27387 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-21-780 · Security Note
• https://cert-portal.siemens.com/productcert/pdf/ssa-133038.pdf · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-27387 · Vendor Advisory