PT-2022-3213 · Siemens · Jt2Go+1

Published 2022-04-11 · Updated 2022-05-26 · CVE-2022-29028

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions JT2Go versions prior to V13.3.0.3 Teamcenter Visualization V13.3 versions prior to V13.3.0.3 Teamcenter Visualization V14.0 versions prior to V14.0.0.1

Description A vulnerability has been identified in the Tiff Loader.dll, which is susceptible to an infinite loop condition when parsing specially crafted TIFF files. This could allow an attacker to crash the application, resulting in a denial of service condition. The vulnerability can be exploited by opening a maliciously crafted file, potentially leading to a denial of service.

Recommendations For JT2Go versions prior to V13.3.0.3, update to version V13.3.0.3 or later. For Teamcenter Visualization V13.3 versions prior to V13.3.0.3, update to version V13.3.0.3 or later. For Teamcenter Visualization V14.0 versions prior to V14.0.0.1, update to version V14.0.0.1 or later. As a temporary workaround, consider restricting the use of the Tiff Loader.dll until a patch is available. Avoid opening specially crafted TIFF files to minimize the risk of exploitation.

Fix

Infinite Loop

Weakness Enumeration

CWE-835

Related Identifiers

BDU:2022-03908

CVE-2022-29028

Affected Products

Jt2Go

Teamcenter Visualization

References · 5

• https://cert-portal.siemens.com/productcert/pdf/ssa-553086.pdf · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-03908 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-29028 · Security Note
• https://osv.dev/vulnerability/CVE-2022-29028 · Vendor Advisory
• https://vuldb.com/ru/?id.200451 · Note