ASM and PAR File Parsing Vulnerabilities in JT2Go and Teamcenter Visualization before V13.1.0.2
Plan Patch7.8SSA-695540May 17, 2021
Attack VectorLocal
Auth RequiredNone
ComplexityLow
User InteractionRequired
Summary
JT2Go and Teamcenter Visualization contain parsing vulnerabilities in ASM and PAR file format handlers (CWE-822, CWE-125, CWE-121) that can be triggered when a user opens a malicious file. The vulnerabilities could result in application crash, arbitrary code execution, or data extraction on the affected system.
What this means
What could happen
An attacker could trick a design engineer or technician into opening a malicious CAD file, resulting in the application crashing, code execution with the user's privileges, or theft of engineering drawings and design data.
Who's at risk
Design engineers, CAD technicians, and engineering workstations running JT2Go or Teamcenter Visualization. Organizations that rely on these products for 3D CAD visualization and design review in manufacturing, aerospace, utilities, and industrial automation environments.
How it could be exploited
An attacker crafts a malicious ASM or PAR file and sends it to a user (via email, file share, or social engineering). When the user opens the file in JT2Go or Teamcenter Visualization, the vulnerable parser processes the malformed file and either crashes the application or executes arbitrary code with the user's privileges.
Prerequisites
- User must be tricked into opening a malicious ASM or PAR file
- Vulnerable version of JT2Go or Teamcenter Visualization must be installed
User-assisted attack (social engineering required)Low complexityNo authentication requiredAffects engineering/design workstations
Exploitability
Moderate exploit probability (EPSS 1.0%)
Affected products (2)
2 with fix
ProductAffected VersionsFix Status
JT2Go< V13.1.0.213.1.0.2
Teamcenter Visualization< V13.1.0.213.1.0.2
Remediation & Mitigation
0/4
Do now
0/1WORKAROUNDImplement file type restrictions or email controls to block ASM and PAR files from external sources until patched
Schedule — requires maintenance window
0/2Patching may require device reboot — plan for process interruption
JT2Go
HOTFIXUpdate JT2Go to version 13.1.0.2 or later
Teamcenter Visualization
HOTFIXUpdate Teamcenter Visualization to version 13.1.0.2 or later
Long-term hardening
0/1HARDENINGTrain users not to open CAD files (ASM, PAR, JT formats) from untrusted sources or unknown senders
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/15e5ad3c-27ed-4817-98e6-3c8b36fb46f5