As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens’ ProductCERT Security Advisories (CERT Services | Services | Siemens Global).
View CSAF
1. EXECUTIVE SUMMARY
- CVSS v3 7.8
- ATTENTION: Low attack complexity
- Vendor: Siemens
- Equipment: Parasolid
- Vulnerabilities: Out-of-bounds Write
2. RISK EVALUATION
Successful exploitation of these vulnerabilities could allow an attacker to execute code in the context of the current process.
3. TECHNICAL DETAILS
3.1 AFFECTED PRODUCTS
The following versions of Siemens Parasolid, a 3D geometric modeling tool, are affected:
- Parasolid V34.1: all versions prior to V34.1.258
- Parasolid V35.0: all versions prior to V35.0.253
- Parasolid V35.0: all versions prior to V35.0.260
- Parasolid V35.1: all versions prior to V35.1.184
- Parasolid V35.1: all versions prior to V35.1.246
- Parasolid V36.0: all versions prior to V36.0.142
- Parasolid V36.0: all versions prior to V36.0.156
3.2 Vulnerability Overview
3.2.1 OUT-OF-BOUNDS WRITE CWE-787
The affected application contains an out of bounds write past the end of an allocated structure while parsing specially crafted X_T files. This could allow an attacker to execute code in the context of the current process.
CVE-2023-41032 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
3.2.2 This article has been indexed from All CISA Advisories