PT-2023-5461 · Siemens · Parasolid+1

Published 2023-09-12 · Updated 2024-02-16 · CVE-2023-41033

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Parasolid versions prior to V35.0.260 Parasolid versions prior to V35.1.246 Parasolid versions prior to V36.0.156 Simcenter Femap versions prior to V2301.0003 Simcenter Femap versions prior to V2306.0001

Description The affected application contains an out of bounds write past the end of an allocated structure while parsing specially crafted X T files. This could allow an attacker to execute code in the context of the current process.

Recommendations For Parasolid versions prior to V35.0.260, update to version V35.0.260 or later. For Parasolid versions prior to V35.1.246, update to version V35.1.246 or later. For Parasolid versions prior to V36.0.156, update to version V36.0.156 or later. For Simcenter Femap versions prior to V2301.0003, update to version V2301.0003 or later. For Simcenter Femap versions prior to V2306.0001, update to version V2306.0001 or later. As a temporary workaround, consider restricting access to X T file parsing until a patch is available.

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

BDU:2023-06091

CVE-2023-41033

ZDI-23-1634

Affected Products

Parasolid

Simcenter Femap

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2023-41033 · Security Note
• https://bdu.fstec.ru/vul/2023-06091 · Security Note
• https://cert-portal.siemens.com/productcert/pdf/ssa-190839.pdf · Vendor Advisory
• https://cert-portal.siemens.com/productcert/pdf/ssa-887122.pdf · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-41033 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-23-1634 · Security Note
• https://t.me/cibsecurity/70268 · Telegram Post
• https://vuldb.com/?id.239520 · Note
• https://twitter.com/CVEnew/status/1701534355816906938 · Twitter Post