As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens’ ProductCERT Security Advisories (CERT Services | Services | Siemens Global).
1. EXECUTIVE SUMMARY
- CVSS v3 7.8
- ATTENTION: Low attack complexity
- Vendor: Siemens
- Equipment: Simcenter Nastran
- Vulnerability: Stack-based Buffer Overflow
2. RISK EVALUATION
Successful exploitation of this vulnerability could allow an attacker to execute code in the context of the current process.
3. TECHNICAL DETAILS
3.1 AFFECTED PRODUCTS
The following versions of Siemens Simcenter Nastran, a finite element analysis program, are affected:
- Simcenter Nastran 2306: All versions
- Simcenter Nastran 2312: All versions
- Simcenter Nastran 2406: All versions prior to V2406.90
3.2 Vulnerability Overview
3.2.1 STACK-BASED BUFFER OVERFLOW CWE-121
The affected applications contain a stack overflow vulnerability while parsing specially crafted strings as argument for one of the application binaries. This could allow an attacker to execute code in the context of the current process.
CVE-2024-33577 has been assigned to this vulnerability. A CVSS v3.1 base score of 7.8 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
A CVSS v4 score
[…]
Content was cut in order to protect the source.Please visit the source for the rest of the article.
Read the original article: