ZDI-21-837: Siemens JT2Go BMP File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Siemens JT2Go. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of BMP files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process.
Affected Software
Event History
Frequently Asked Questions
What is the severity of ZDI-21-837?
The severity of ZDI-21-837 is considered high due to its potential for sensitive information disclosure.
How do I fix ZDI-21-837?
To remediate ZDI-21-837, apply the latest security updates provided by Siemens for the JT2Go application.
What type of attack vector does ZDI-21-837 utilize?
ZDI-21-837 can be exploited through social engineering by tricking the user into visiting a malicious webpage or opening a crafted file.
Who is affected by ZDI-21-837?
ZDI-21-837 affects installations of Siemens JT2Go used in various environments.
What is the nature of the vulnerability described in ZDI-21-837?
The vulnerability in ZDI-21-837 allows remote attackers to disclose sensitive information from affected installations of Siemens JT2Go.