PT-2022-22314 · Siemens · Simcenter Femap

Published 2022-07-12 · Updated 2022-07-15 · CVE-2022-34748

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Simcenter Femap versions prior to V2022.2

Description A vulnerability has been identified in the affected application, which contains an out of bounds write past the end of an allocated structure while parsing specially crafted X T files. This could allow an attacker to execute code in the context of the current process.

Recommendations For versions prior to V2022.2, update to version V2022.2 or later to resolve the issue. As a temporary workaround, consider restricting the parsing of X T files to minimize the risk of exploitation. Avoid using specially crafted X T files until the issue is resolved.

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2022-34748

ZDI-22-966

Affected Products

Simcenter Femap

References · 5

• https://zerodayinitiative.com/advisories/ZDI-22-966 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-34748 · Security Note
• https://osv.dev/vulnerability/CVE-2022-34748 · Vendor Advisory
• https://cert-portal.siemens.com/productcert/pdf/ssa-474231.pdf · Vendor Advisory
• https://t.me/cibsecurity/45962 · Telegram Post