PT-2024-1964 · Siemens · Simcenter Femap

Published 2024-02-13 · Updated 2024-10-03 · CVE-2024-24923

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Simcenter Femap versions prior to V2401.0000 Simcenter Femap versions prior to V2306.0001

Description A vulnerability has been identified in Simcenter Femap that is related to an out of bounds read past the end of an allocated structure while parsing specially crafted Catia MODEL files. This could allow an attacker to execute code in the context of the current process. The vulnerability is associated with a buffer read beyond the memory boundaries.

Recommendations For Simcenter Femap versions prior to V2401.0000, update to version V2401.0000 or later. For Simcenter Femap versions prior to V2306.0001, update to version V2306.0001 or later. As a temporary workaround, consider avoiding the use of specially crafted Catia MODEL files until a patch is available. Restrict access to the Catia MODEL file parsing functionality to minimize the risk of exploitation.

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

BDU:2024-01790

CVE-2024-24923

ZDI-24-179

Affected Products

Simcenter Femap

References · 10

• https://bdu.fstec.ru/vul/2024-01790 · Security Note
• https://cert-portal.siemens.com/productcert/html/ssa-000072.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-24923 · Security Note
• https://osv.dev/vulnerability/CVE-2024-24923 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-24-179 · Security Note
• https://vuldb.com/?id.253556 · Note
• https://twitter.com/CVEnew/status/1757332538366832954 · Twitter Post
• https://cybersecurity-help.cz/vdb/SB2024021427 · Note
• https://twitter.com/VulmonFeeds/status/1757371098142830680 · Twitter Post
• http://zerodayinitiative.com/advisories/ZDI-24-179 · Note