PT-2021-19996 · Unknown · Drawings Sdk

Mat Powell · Published 2021-06-17 · Updated 2023-02-09 · CVE-2021-32952

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Drawings SDK versions 2022.4 and prior

Description An out-of-bounds write issue exists in the DGN file-reading procedure due to the lack of proper validation of user-supplied data. This can result in a write past the end of an allocated buffer and allow attackers to cause a denial-of-service condition or execute code in the context of the current process.

Recommendations For versions 2022.4 and prior, consider disabling the DGN file-reading procedure until a patch is available to prevent potential exploitation. Restrict access to the Drawings SDK to minimize the risk of exploitation. Avoid using the Drawings SDK for parsing DGN files until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2021-32952

ZDI-21-989

ZDI-23-123

Affected Products

Drawings Sdk

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2021-32952 · Security Note
• https://cert-portal.siemens.com/productcert/pdf/ssa-938030.pdf · Patch
• https://cert-portal.siemens.com/productcert/pdf/ssa-155599.pdf · Patch
• https://zerodayinitiative.com/advisories/ZDI-21-989 · Security Note
• https://osv.dev/vulnerability/CVE-2021-32952 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-23-123 · Security Note
• https://t.me/cvenotify/18980 · Telegram Post
• https://t.me/cvenotify/16515 · Telegram Post
• https://us-cert.cisa.gov/ics/advisories/icsa-21-159-02 · Note
• https://t.me/cibsecurity/25519 · Telegram Post
• https://t.me/cvenotify/19642 · Telegram Post