PT-2021-23475 · Siemens · Simcenter Star-Ccm+ Viewer

Published 2021-12-14 · Updated 2021-12-20 · CVE-2021-42024

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Simcenter STAR-CCM+ Viewer versions prior to 2021.3.1

Description A vulnerability has been identified in the starview+.exe application, which lacks proper validation of user-supplied data when parsing scene files. This could result in an out of bounds write past the end of an allocated structure, allowing an attacker to execute code in the context of the current process.

Recommendations For versions prior to 2021.3.1, update to version 2021.3.1 or later to resolve the issue. As a temporary workaround, consider restricting the use of the starview+.exe application until a patch is applied. Avoid using the application to parse untrusted scene files until the issue is resolved.

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2021-42024

Affected Products

Simcenter Star-Ccm+ Viewer

References · 3

• https://osv.dev/vulnerability/CVE-2021-42024 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-42024 · Security Note
• https://cert-portal.siemens.com/productcert/pdf/ssa-161331.pdf · Vendor Advisory