PT-2022-2725 · Siemens · Jt2Go+1

Published 2022-04-11 · Updated 2022-05-26 · CVE-2022-29033

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions JT2Go versions prior to V13.3.0.3 Teamcenter Visualization V13.3 versions prior to V13.3.0.3 Teamcenter Visualization V14.0 versions prior to V14.0.0.1

Description A vulnerability has been identified in the CGM NIST Loader.dll library, which is used by JT2Go and Teamcenter Visualization. The library is vulnerable to an uninitialized pointer free while parsing specially crafted CGM files. This could allow an attacker to execute code in the context of the current process by opening a maliciously crafted CGM, TIFF, or TG4 file.

Recommendations For JT2Go versions prior to V13.3.0.3, update to version V13.3.0.3 or later. For Teamcenter Visualization V13.3 versions prior to V13.3.0.3, update to version V13.3.0.3 or later. For Teamcenter Visualization V14.0 versions prior to V14.0.0.1, update to version V14.0.0.1 or later. As a temporary workaround, consider disabling the use of the CGM NIST Loader.dll library until a patch is available. Avoid opening specially crafted CGM files from untrusted sources.

Fix

Access of Uninitialized Pointer

Weakness Enumeration

CWE-824

Related Identifiers

BDU:2022-03229

CVE-2022-29033

Affected Products

Jt2Go

Teamcenter Visualization

References · 7

• https://bdu.fstec.ru/vul/2022-03229 · Security Note
• https://cert-portal.siemens.com/productcert/pdf/ssa-553086.pdf · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-29033 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-29033 · Security Note
• https://vuldb.com/ru/?id.200456 · Note
• https://t.me/cibsecurity/43041 · Telegram Post
• https://github.com/advisories/GHSA-mm9v-95j4-52gp · Note