PT-2022-3374 · Siemens · Jt2Go+1

Published 2022-04-11 · Updated 2022-05-26 · CVE-2022-29031

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions JT2Go versions prior to V13.3.0.3 Teamcenter Visualization V13.3 versions prior to V13.3.0.3 Teamcenter Visualization V14.0 versions prior to V14.0.0.1

Description A null pointer dereference vulnerability has been identified in the CGM NIST Loader.dll while parsing specially crafted CGM files. This issue can be exploited by an attacker to crash the application, causing a denial of service condition. The vulnerability can be triggered by specially crafted CGM, TIFF, or TG4 files.

Recommendations For JT2Go versions prior to V13.3.0.3, update to version V13.3.0.3 or later to resolve the issue. For Teamcenter Visualization V13.3 versions prior to V13.3.0.3, update to version V13.3.0.3 or later to resolve the issue. For Teamcenter Visualization V14.0 versions prior to V14.0.0.1, update to version V14.0.0.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the CGM NIST Loader.dll to minimize the risk of exploitation. Avoid using the vulnerable CGM NIST Loader.dll until the issue is resolved.

Fix

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

BDU:2022-04143

CVE-2022-29031

Affected Products

Jt2Go

Teamcenter Visualization

References · 6

• https://osv.dev/vulnerability/CVE-2022-29031 · Vendor Advisory
• https://cert-portal.siemens.com/productcert/pdf/ssa-553086.pdf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-29031 · Security Note
• https://bdu.fstec.ru/vul/2022-04143 · Security Note
• https://vuldb.com/ru/?id.200454 · Note
• https://t.me/cibsecurity/43030 · Telegram Post