PT-2022-3373 · Siemens · Jt2Go+1

Published 2022-04-11 · Updated 2022-05-26 · CVE-2022-29029

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions JT2Go versions prior to V13.3.0.3 Teamcenter Visualization V13.3 versions prior to V13.3.0.3 Teamcenter Visualization V14.0 versions prior to V14.0.0.1

Description A null pointer dereference vulnerability has been identified in the CGM NIST Loader.dll while parsing specially crafted CGM files. This issue can be exploited by an attacker to crash the application, causing a denial of service condition. The vulnerability can be triggered by specially crafted CGM, TIFF, or TG4 files.

Recommendations For JT2Go versions prior to V13.3.0.3, update to version V13.3.0.3 or later to resolve the issue. For Teamcenter Visualization V13.3 versions prior to V13.3.0.3, update to version V13.3.0.3 or later to resolve the issue. For Teamcenter Visualization V14.0 versions prior to V14.0.0.1, update to version V14.0.0.1 or later to resolve the issue. As a temporary workaround, consider restricting the use of the CGM NIST Loader.dll to minimize the risk of exploitation. Avoid using the vulnerable library to parse CGM files until the issue is resolved.

Fix

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

BDU:2022-04142

CVE-2022-29029

Affected Products

Jt2Go

Teamcenter Visualization

References · 6

• https://bdu.fstec.ru/vul/2022-04142 · Security Note
• https://cert-portal.siemens.com/productcert/pdf/ssa-553086.pdf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-29029 · Security Note
• https://osv.dev/vulnerability/CVE-2022-29029 · Vendor Advisory
• https://vuldb.com/ru/?id.200452 · Note
• https://t.me/cibsecurity/43042 · Telegram Post