As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens’ ProductCERT Security Advisories (CERT Services | Services | Siemens Global).
1. EXECUTIVE SUMMARY
- CVSS v3 7.8
- ATTENTION: Low Attack Complexity
- Vendor: Siemens
- Equipment: PS/IGES Parasolid Translator Component
- Vulnerabilities: Out-of-bounds Read, Type Confusion, Improper Restriction of Operations within the Bounds of a Memory Buffer
2. RISK EVALUATION
Successful exploitation of these vulnerabilities could lead the application to crash or potentially lead to arbitrary code execution.
3. TECHNICAL DETAILS
3.1 AFFECTED PRODUCTS
Siemens reports that the following single-format translator toolkits are affected:
- PS/IGES Parasolid Translator Component: versions prior to V27.1.215
3.2 Vulnerability Overview
3.2.1 OUT-OF-BOUNDS READ CWE-125
The affected applications contain an out-of-bounds read past the end of an allocated structure while parsing specially crafted IGS files. This could allow an attacker to execute code in the context of the current process.
CVE-2024-32055 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
A CVSS v4 score has also bee
[…]
Content was cut in order to protect the source.Please visit the source for the rest of the article.
Read the original article: