{ "document": { "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Disclosure is not limited.", "tlp": { "label": "WHITE" } }, "notes": [ { "category": "summary", "text": "Simcenter Femap and Parasolid are affected by an out of bounds read\nvulnerability that could be triggered when the application reads files\nin NEU format. If a user is tricked to open a malicious file with the\naffected applications, an attacker could leverage the vulnerability to\nperform remote code execution in the context of the current process.\nSiemens has released updates for the affected products and recommends\nto update to the latest versions.", "title": "Summary" }, { "category": "general", "text": "As a general security measure, Siemens strongly recommends to protect\nnetwork access to devices with appropriate mechanisms. In order to\noperate the devices in a protected IT environment, Siemens recommends\nto configure the environment according to Siemens' operational\nguidelines for Industrial Security (Download:\nhttps://www.siemens.com/cert/operational-guidelines-industrial-\nsecurity), and to follow the recommendations in the product manuals.\n\nAdditional information on Industrial Security by Siemens can be found\nat: https://www.siemens.com/industrialsecurity", "title": "General Recommendations" }, { "category": "general", "text": "For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories", "title": "Additional Resources" }, { "category": "legal_disclaimer", "text": "Siemens Security Advisories are subject to the terms and conditions contained in Siemens' underlying license terms or other applicable agreements previously agreed to with Siemens (hereinafter \"License Terms\"). To the extent applicable to information, software or documentation made available in or through a Siemens Security Advisory, the Terms of Use of Siemens' Global Website (https://www.siemens.com/terms_of_use, hereinafter \"Terms of Use\"), in particular Sections 8-10 of the Terms of Use, shall apply additionally. In case of conflicts, the License Terms shall prevail over the Terms of Use.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "productcert@siemens.com", "name": "Siemens ProductCERT", "namespace": "https://www.siemens.com" }, "references": [ { "category": "self", "summary": "SSA-243317 File Parsing Vulnerability in Simcenter Femap and Parasolid - PDF Version", "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-243317.pdf" }, { "category": "self", "summary": "SSA-243317 File Parsing Vulnerability in Simcenter Femap and Parasolid - TXT Version", "url": "https://cert-portal.siemens.com/productcert/txt/ssa-243317.txt" }, { "category": "self", "summary": "SSA-243317 File Parsing Vulnerability in Simcenter Femap and Parasolid - CSAF Version", "url": "https://cert-portal.siemens.com/productcert/csaf/ssa-243317.json" } ], "title": "SSA-243317 File Parsing Vulnerability in Simcenter Femap and Parasolid", "tracking": { "current_release_date": "2022-09-13T00:00:00Z", "generator": { "engine": { "name": "Siemens ProductCERT CSAF Generator", "version": "1" } }, "id": "SSA-243317", "initial_release_date": "2022-07-12T00:00:00Z", "revision_history": [ { "date": "2022-07-12T00:00:00Z", "legacy_version": "1.0", "number": "1", "summary": "Publication Date" }, { "date": "2022-08-09T00:00:00Z", "legacy_version": "1.1", "number": "2", "summary": "Added fix for Parasolid version line V33.1" }, { "date": "2022-09-13T00:00:00Z", "legacy_version": "1.2", "number": "3", "summary": "Added fix for Simcenter Femap version lines V2022.1 and V2022.2" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "< V33.1.264", "product": { "name": "Parasolid V33.1", "product_id": "1" } } ], "category": "product_name", "name": "Parasolid V33.1" }, { "branches": [ { "category": "product_version_range", "name": "< V34.0.250", "product": { "name": "Parasolid V34.0", "product_id": "2" } } ], "category": "product_name", "name": "Parasolid V34.0" }, { "branches": [ { "category": "product_version_range", "name": "< V34.1.233", "product": { "name": "Parasolid V34.1", "product_id": "3" } } ], "category": "product_name", "name": "Parasolid V34.1" }, { "branches": [ { "category": "product_version_range", "name": "< V2022.1.3", "product": { "name": "Simcenter Femap V2022.1", "product_id": "4" } } ], "category": "product_name", "name": "Simcenter Femap V2022.1" }, { "branches": [ { "category": "product_version_range", "name": "< V2022.2.2", "product": { "name": "Simcenter Femap V2022.2", "product_id": "5" } } ], "category": "product_name", "name": "Simcenter Femap V2022.2" } ], "category": "vendor", "name": "Siemens" } ] }, "vulnerabilities": [ { "cve": "CVE-2022-34465", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "summary", "text": "The affected application contains an out of bounds read past the end of an allocated structure while parsing specially crafted NEU files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-15420)", "title": "Summary" } ], "product_status": { "known_affected": [ "1", "2", "3", "4", "5" ] }, "remediations": [ { "category": "mitigation", "details": "Do not open untrusted NEU files in Simcenter Femap or Parasolid", "product_ids": [ "1", "2", "3", "4", "5" ] }, { "category": "vendor_fix", "details": "Update to V33.1.264 or later version", "product_ids": [ "1" ], "url": "https://support.sw.siemens.com/" }, { "category": "vendor_fix", "details": "Update to V34.0.250 or later version", "product_ids": [ "2" ], "url": "https://support.sw.siemens.com/" }, { "category": "vendor_fix", "details": "Update to V34.1.233 or later version", "product_ids": [ "3" ], "url": "https://support.sw.siemens.com/" }, { "category": "vendor_fix", "details": "Update to V2022.1.3 or later version", "product_ids": [ "4" ], "url": "https://support.sw.siemens.com/" }, { "category": "vendor_fix", "details": "Update to V2022.2.2 or later version", "product_ids": [ "5" ], "url": "https://support.sw.siemens.com/" } ], "scores": [ { "cvss_v3": { "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C", "version": "3.1" }, "products": [ "1", "2", "3", "4", "5" ] } ], "title": "CVE-2022-34465" } ] }