PT-2024-22123 · Siemens · Simcenter Femap

Published 2024-03-12 · Updated 2024-03-28 · CVE-2024-27907

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Simcenter Femap versions prior to V2306.0000

Description A vulnerability has been identified in the affected application, which contains an out of bounds write past the end of an allocated buffer while parsing a specially crafted Catia MODEL file. This could allow an attacker to execute code in the context of the current process.

Recommendations For versions prior to V2306.0000, update to version V2306.0000 or later to resolve the issue. As a temporary workaround, consider restricting the parsing of Catia MODEL files to minimize the risk of exploitation. Avoid using the affected application to parse specially crafted files until the issue is resolved.

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2024-27907

ZDI-24-356

Affected Products

Simcenter Femap

References · 7

• https://zerodayinitiative.com/advisories/ZDI-24-356 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-27907 · Security Note
• https://cert-portal.siemens.com/productcert/html/ssa-000072.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-27907 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1767529313652380054 · Twitter Post
• https://twitter.com/cracbot/status/1767989725283938714 · Twitter Post
• https://twitter.com/CVEnew/status/1767498439645176257 · Twitter Post