PT-2024-7986 · Siemens · Simcenter Nastran+1

Michael Heinzl · Published 2024-10-08 · Updated 2024-12-10 · CVE-2024-41981

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Simcenter Femap versions V2306 through V2406 Simcenter Nastran versions 2306 through 2312

Description The issue is related to a heap-based buffer overflow in the BDF File Handler component. This occurs when the application parses specially crafted BDF files, potentially allowing an attacker to execute arbitrary code in the context of the current process.

Recommendations For Simcenter Femap versions V2306 through V2406, avoid using the BDF File Handler component until a patch is available. For Simcenter Nastran versions 2306 through 2312, restrict access to the BDF file parsing functionality to minimize the risk of exploitation. As a temporary workaround, consider disabling the BDF file handling feature in both Simcenter Femap and Simcenter Nastran until a fix is provided.

Fix

Heap Based Buffer Overflow

Weakness Enumeration

CWE-122

Related Identifiers

BDU:2024-09500

CVE-2024-41981

Affected Products

Simcenter Femap

Simcenter Nastran

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2024-41981 · Security Note
• https://bdu.fstec.ru/vul/2024-09500 · Security Note
• https://vulners.com/cve/CVE-2024-41981 · Note
• https://t.me/latest_high_impact_cve/1291 · Telegram Post
• https://twitter.com/CharyyevPerman/status/1845491649725841650 · Twitter Post
• https://vuldb.com/?id.279593 · Note
• https://cert-portal.siemens.com/productcert/html/ssa-852501.html · Note
• https://cert-portal.siemens.com/productcert/html/ssa-881356.html · Note
• https://twitter.com/cracbot/status/1845343787851317309 · Twitter Post
• https://twitter.com/vuldb/status/1843590169586479404 · Twitter Post