CVE-2021-43336
published 2021-11-14CVE-2021-43336: An Out-of-Bounds Write vulnerability exists when reading a DXF or DWG file using Open Design Alliance Drawings SDK before 2022.11. The specific issue exists…
PriorityP341high7.8CVSS 3.1
AVLACLPRNUIRSUCHIHAH
EPSS
1.64%
73.8th percentile
An Out-of-Bounds Write vulnerability exists when reading a DXF or DWG file using Open Design Alliance Drawings SDK before 2022.11. The specific issue exists within the parsing of DXF and DWG files. Crafted data in a DXF or DWG file (an invalid number of properties) can trigger a write operation past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| opendesign | drawings_software_development_kit | < 2022.11 | 2022.11 |
| siemens | solid_edge | — | — |
| siemens | teamcenter_visualization | — | — |
| siemens | teamcenter_visualization | >= 12.4.0 < 12.4.0.13 | 12.4.0.13 |
| siemens | teamcenter_visualization | >= 13.2.0 < 13.3.0.1 | 13.3.0.1 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA ICS
Siemens Solid Edge
cisa_ics·2023-02-16·CVSS 7.8
[HIGH] Siemens Solid Edge
ICS Advisory
##
Siemens Solid Edge
Release DateFebruary 16, 2023
Alert CodeICSA-23-047-01
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global).
## 1. EXECUTIVE SUMMARY
- CVSS v3 7.8
- ATTENTION: Low attack complexity
- Vendor: Siemens
- Equipment: Solid Edge
- Vulnerabilities: Out-of-bounds Write, Out-of-bounds Read, Heap-based Buffer Overflow, Stack-based Buffer Overflow, Access of Uninitialized Pointer, Improper Restriction of Operations within the Bounds of a Memory Buffer, Use After Free
## 2. RIS
CISA ICS
Siemens Solid Edge, JT2Go, and Teamcenter Visualization (Update C)
cisa_ics·2022-04-14
Siemens Solid Edge, JT2Go, and Teamcenter Visualization (Update C)
## Archived Content In an effort to keep CISA.gov current, the archive contains outdated information that may not reflect current policy or programs.
ICS Advisory
##
Siemens Solid Edge, JT2Go, and Teamcenter Visualization (Update C)
Last RevisedJune 16, 2022
Alert CodeICSA-22-041-07
## 1. EXECUTIVE SUMMARY
- CVSS v3 7.8
- ATTENTION: Low attack complexity
- Vendor: Siemens
- Equipment: Solid Edge, JT2Go, and Teamcenter Visualization
- Vulnerabilities: Improper Restriction of Operations within the Bounds of a Memory Buffer, Out-of-bounds Write, Heap-based Buffer Overflow, Out-of-bounds Read
## 2. UPDATE INFORMATION
This updated advisory is a follow-up to the advisory update ICSA-22-041-07 Siemens Solid Edge, JT2Go, and Teamcenter Visuali
GHSA
GHSA-25gw-crq8-3qhc: An Out-of-Bounds Write vulnerability exists when reading a DXF file using Open Design Alliance Drawings SDK before 2022
ghsa_unreviewed·2022-05-24
CVE-2021-43336 [HIGH] CWE-787 GHSA-25gw-crq8-3qhc: An Out-of-Bounds Write vulnerability exists when reading a DXF file using Open Design Alliance Drawings SDK before 2022
An Out-of-Bounds Write vulnerability exists when reading a DXF file using Open Design Alliance Drawings SDK before 2022.11. The specific issue exists within the parsing of DXF files. Crafted data in a DXF file (an invalid number of properties) can trigger a write operation past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://cert-portal.siemens.com/productcert/pdf/ssa-301589.pdfhttps://cert-portal.siemens.com/productcert/pdf/ssa-491245.pdfhttps://www.opendesign.com/security-advisorieshttps://www.zerodayinitiative.com/advisories/ZDI-22-334/https://cert-portal.siemens.com/productcert/pdf/ssa-301589.pdfhttps://cert-portal.siemens.com/productcert/pdf/ssa-491245.pdfhttps://www.opendesign.com/security-advisorieshttps://www.zerodayinitiative.com/advisories/ZDI-22-334/
2021-11-14
Published