PT-2021-7803 · Siemens · Syngo Fastview

Published 2021-12-14 · Updated 2024-01-10 · CVE-2021-45465

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions syngo fastView (All versions)

Description A vulnerability has been identified in the affected application, which lacks proper validation of user-supplied data when parsing BMP files. This could result in a write-what-where condition, allowing an attacker to execute code in the context of the current process.

Recommendations As a temporary workaround, consider disabling the BMP file parsing functionality until a patch is available. Restrict access to the affected application to minimize the risk of exploitation. Avoid using the affected application to parse BMP files from untrusted sources until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-123

Related Identifiers

BDU:2023-02951

CVE-2021-45465

ZDI-22-531

Affected Products

Syngo Fastview

References · 8

• https://zerodayinitiative.com/advisories/ZDI-22-531 · Security Note
• https://bdu.fstec.ru/vul/2023-02951 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-45465 · Security Note
• https://siemens-healthineers.com/en-us/support-documentation/cybersecurity/shsa-688797 · Vendor Advisory
• https://siemens-healthineers.com/support-documentation/cybersecurity/shsa-688797 · Note
• https://t.me/cibsecurity/74404 · Telegram Post
• https://cisa.gov/news-events/ics-advisories/icsa-21-350-16 · Note
• https://t.me/cvenotify/66171 · Telegram Post