PT-2022-2577 · Siemens · Simcenter Femap

Xina1I · Published 2022-02-08 · Updated 2022-03-24 · CVE-2021-46699

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Simcenter Femap versions prior to V2022.1.1

Description A stack-based buffer overflow vulnerability has been identified in Simcenter Femap while parsing specially crafted BDF files. This could allow an attacker to execute code in the context of the current process. The vulnerability can be exploited by a remote attacker, allowing them to execute arbitrary code when analyzing specially crafted files.

Recommendations For versions prior to V2022.1.1, update to version V2022.1.1 or later to resolve the issue. As a temporary workaround, consider restricting the use of BDF file parsing functionality until a patch is available. Avoid using specially crafted BDF files in the affected application until the issue is resolved.

Fix

Memory Corruption

Stack Overflow

Weakness Enumeration

CWE-787

CWE-121

Related Identifiers

BDU:2022-03021

CVE-2021-46699

ZDI-22-509

Affected Products

Simcenter Femap

References · 6

• https://cert-portal.siemens.com/productcert/pdf/ssa-949188.pdf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-46699 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-22-509 · Security Note
• https://bdu.fstec.ru/vul/2022-03021 · Security Note
• https://osv.dev/vulnerability/CVE-2021-46699 · Vendor Advisory
• https://t.me/cibsecurity/37894 · Telegram Post