DGN and PAR File Parsing Vulnerabilities in JT2Go and Teamcenter Visualization before V13.2.0.2
Plan Patch7.8SSA-938030Aug 10, 2021
Attack VectorLocal
Auth RequiredNone
ComplexityLow
User InteractionRequired
Summary
Three vulnerabilities in the DGN and PAR file parsers of JT2Go and Teamcenter Visualization could cause the application to crash or allow arbitrary code execution when a user opens a malicious file. The vulnerabilities involve improper exception handling (CWE-754), out-of-bounds write (CWE-787), and out-of-bounds read (CWE-125). Siemens recommends updating to V13.2.0.2 or later and avoiding opening untrusted files from unknown sources.
What this means
What could happen
A user opening a malicious DGN or PAR file in JT2Go or Teamcenter Visualization could allow an attacker to crash the application or execute arbitrary code on the user's workstation with the privileges of that user account.
Who's at risk
Engineering and design teams at utilities, manufacturing facilities, and other organizations that use Siemens JT2Go or Teamcenter Visualization to review CAD files should update. This affects any user who opens DGN or PAR files with these products, particularly those who receive files from external consultants or suppliers.
How it could be exploited
An attacker creates a specially crafted DGN or PAR file (CAD file formats) and tricks or socially engineers a user into opening it with JT2Go or Teamcenter Visualization. When the application parses the malicious file, memory safety vulnerabilities in the file parser trigger, leading to a crash or code execution on the workstation.
Prerequisites
- User must open a malicious DGN or PAR file with JT2Go or Teamcenter Visualization
- Affected product version prior to V13.2.0.2 must be installed
User interaction required (file open)low exploit complexitymemory safety vulnerabilityarbitrary code execution possible
Exploitability
Low exploit probability (EPSS 0.3%)
Affected products (2)
2 with fix
ProductAffected VersionsFix Status
JT2Go< V13.2.0.213.2.0.2
Teamcenter Visualization< V13.2.0.213.2.0.2
Remediation & Mitigation
0/4
Schedule — requires maintenance window
0/2Patching may require device reboot — plan for process interruption
JT2Go
HOTFIXUpdate JT2Go to version 13.2.0.2 or later
Teamcenter Visualization
HOTFIXUpdate Teamcenter Visualization to version 13.2.0.2 or later
Long-term hardening
0/2JT2Go
HARDENINGRestrict file types and sources that can be opened in JT2Go and Teamcenter Visualization through organizational policy or access controls
All products
HARDENINGTrain users not to open DGN or PAR files from untrusted or unknown sources; establish file review process for CAD files received externally
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/88a7ea1b-ae10-4946-b19b-79b6f64c9fda