PT-2021-2372 · Cscape · Cscape

Francis Provencher · Published 2021-02-09 · Updated 2021-05-03 · CVE-2021-22663

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cscape versions prior to 9.90 SP3.5

Description The issue is related to the lack of proper validation of user-supplied data when parsing project files, which could lead to an out-of-bounds read. This could allow an attacker to execute code in the context of the current process, potentially impacting the confidentiality, integrity, and availability of protected information.

Recommendations For versions prior to 9.90 SP3.5, update to version 9.90 SP3.5 or later to resolve the issue. As a temporary workaround, consider restricting the parsing of project files from untrusted sources until a patch is applied.

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

BDU:2021-01612

CVE-2021-22663

ZDI-21-158

Affected Products

Cscape

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2021-22663 · Security Note
• https://osv.dev/vulnerability/CVE-2021-22663 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-21-158 · Security Note
• https://bdu.fstec.ru/vul/2021-01612 · Security Note
• https://securitylab.ru/vulnerability/516306.php · Note
• https://us-cert.gov/ics/advisories/icsa-21-035-02 · Note
• https://us-cert.cisa.gov/ics/advisories/icsa-21-035-02 · Note