PT-2023-3281 · Unknown+1 · Ifcmesh Library+1

Rgod · Published 2023-03-09 · Updated 2023-08-04 · CVE-2023-0973

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions STEPTools v18SP1 ifcmesh library version 18.1

Description The issue is related to a null pointer dereference in the ifcmesh library, which could allow an attacker to deny application usage when reading a specially constructed file, resulting in an application crash. This could potentially be exploited to cause a denial of service.

Recommendations For STEPTools v18SP1 ifcmesh library version 18.1, consider disabling the library until a patch is available to prevent potential exploitation. As a temporary workaround, avoid using the library to parse specially constructed files that could trigger the null pointer dereference. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

BDU:2023-03414

CVE-2023-0973

ZDI-23-1022

Affected Products

Steptools

Ifcmesh Library

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2023-0973 · Security Note
• https://osv.dev/vulnerability/CVE-2023-0973 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-23-1022 · Security Note
• https://bdu.fstec.ru/vul/2023-03414 · Security Note
• https://cert-portal.siemens.com/productcert/html/ssa-932528.html · Note
• https://t.me/cibsecurity/59930 · Telegram Post
• https://cisa.gov/news-events/ics-advisories/icsa-23-068-04 · Note
• https://t.me/cvenotify/46766 · Telegram Post
• https://vuldb.com/?id.222713 · Note