Stack Overflow Vulnerability in Simcenter Nastran before 2406.90
Plan Patch7.8SSA-258494May 14, 2024
Attack VectorLocal
Auth RequiredNone
ComplexityLow
User InteractionRequired
Summary
Simcenter Nastran contains a stack overflow vulnerability in how the application binary handles file arguments. When a user runs an affected binary with a malicious input string as a file argument, an attacker could execute code with the privileges of the user running the application.
What this means
What could happen
An attacker could run arbitrary commands on an engineering workstation running Simcenter Nastran with the privileges of the user, potentially compromising simulation models, design files, or the workstation itself if used on an OT network.
Who's at risk
Engineering teams and design departments using Simcenter Nastran for mechanical simulation and finite element analysis, particularly on engineering workstations connected to corporate or OT networks.
How it could be exploited
An attacker crafts a malicious file argument string and tricks a user into running a Simcenter Nastran binary with that input. The stack overflow is triggered when the binary processes the string, allowing the attacker to overwrite memory and execute arbitrary code in the process context.
Prerequisites
- User interaction required: victim must be tricked to run the application binary with a malicious argument
- User must have Simcenter Nastran installed on their workstation
User interaction requiredLow attack complexityHigh impact to confidentiality, integrity, and availabilityNo patch available for 2306 and 2312 versions
Exploitability
Low exploit probability (EPSS 0.1%)
Affected products (3)
1 with fix2 EOL
ProductAffected VersionsFix Status
Simcenter Nastran 2406<V2406.902406.90
Simcenter Nastran 2306All versionsNo fix (EOL)
Simcenter Nastran 2312All versionsNo fix (EOL)
Remediation & Mitigation
0/3
Do now
0/1WORKAROUNDEducate users not to run Simcenter Nastran with file arguments from untrusted sources
Schedule — requires maintenance window
0/1Patching may require device reboot — plan for process interruption
Simcenter Nastran 2406
HOTFIXUpdate Simcenter Nastran 2406 to version 2406.90 or later
Mitigations - no patch available
0/1The following products have reached End of Life with no planned fix: Simcenter Nastran 2306, Simcenter Nastran 2312. Apply the following compensating controls:
HARDENINGFor Simcenter Nastran 2306 and 2312 where no fix is planned, restrict user access to Simcenter Nastran binaries and avoid running untrusted input files
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/c3718462-c221-4fad-9efa-f03cfb516724