PT-2021-24002 · Siemens · Jt Open+2

Published 2021-12-14 · Updated 2023-02-21 · CVE-2021-44002

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: JT Open versions prior to 11.1.1.0 JT Utilities versions prior to 13.1.1.0 Solid Edge versions prior to 2023

Description: A vulnerability has been identified that could allow an attacker to execute code in the context of the current process. The issue arises from an out of bounds write past the end of an allocated structure while parsing specially crafted JT files, specifically affecting the Jt1001.dll.

Recommendations: For JT Open versions prior to 11.1.1.0, update to version 11.1.1.0 or later. For JT Utilities versions prior to 13.1.1.0, update to version 13.1.1.0 or later. For Solid Edge versions prior to 2023, update to version 2023 or later.

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2021-44002

ZDI-22-006

ZDI-23-087

ZDI-23-088

Affected Products

Jt Open

Jt Utilities

Solid Edge

References · 7

• https://zerodayinitiative.com/advisories/ZDI-23-088 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-23-087 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-44002 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-22-006 · Security Note
• https://cert-portal.siemens.com/productcert/pdf/ssa-595101.pdf · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-44002 · Vendor Advisory
• https://cert-portal.siemens.com/productcert/pdf/ssa-936212.pdf · Vendor Advisory