CVE-2021-32952: Siemens JT2Go DGN File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability
An out-of-bounds write issue exists in the DGN file-reading procedure in the Drawings SDK (Version 2022.4 and prior) resulting from the lack of proper validation of user-supplied data. This can result in a write past the end of an allocated buffer and allow attackers to cause a denial-of-service condition or execute code in the context of the current process.
Other sources
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Siemens JT2Go. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DGN files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.
Affected Software
Remediation
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2021-32952?
The severity of CVE-2021-32952 is high.
How does CVE-2021-32952 allow remote code execution?
CVE-2021-32952 allows remote code execution by exploiting a flaw in the parsing of DGN files.
Which software is affected by CVE-2021-32952?
Siemens JT2Go, Siemens COMOS, Opendesign Drawings SDK, and Siemens Teamcenter Visualization are affected by CVE-2021-32952.
How can the vulnerability CVE-2021-32952 be exploited?
The vulnerability CVE-2021-32952 can be exploited by visiting a malicious page or opening a malicious DGN file.
Is there a fix available for CVE-2021-32952?
Yes, Siemens has released security updates to address CVE-2021-32952. It is recommended to install the latest updates from Siemens.