description:
The APDFL.dll contains a memory corruption vulnerability while parsing
specially crafted PDF files. This could allow an attacker to execute
code in the context of the current process.
problem types: CWE-119
affected:
{
defaultStatus: unaffected
product: JT2Go
vendor: Siemens
versions:
lessThan: 14.1.0.5, status: affected, version: 0, versionType: custom
}
{
defaultStatus: unaffected
product: Teamcenter Visualization V13.3
vendor: Siemens
versions:
lessThan: 13.3.0.8, status: affected, version: 0, versionType: custom
}
{
defaultStatus: unaffected
product: Teamcenter Visualization V14.0
vendor: Siemens
versions:
lessThan: 14.0.0.4, status: affected, version: 0, versionType: custom
}
{
defaultStatus: unaffected
product: Teamcenter Visualization V14.1
vendor: Siemens
versions:
lessThan: 14.1.0.5, status: affected, version: 0, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
]
format: CVSS
scenarios: GENERAL
solutions: Siemens released updates for the affected products and recommends updating to the latest versions:
*  JT2Go:  Update to V14.1.0.5 or later version https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html .
*  Teamcenter Visualization V13.3:  Update to V13.3.0.8 or later version https://support.sw.siemens.com/ .
*  Teamcenter Visualization V14.0:  Update to V14.0.0.4 or later version https://support.sw.siemens.com/ .
*  Teamcenter Visualization V14.1:  Update to V14.1.0.5 or later version https://support.sw.siemens.com/ .
workarounds: Siemens identified the following specific workaround and mitigation user can apply to reduce risk:
*  Do not open untrusted PDF files in JT2Go and Teamcenter Visualization.
As a general security measure, Siemens recommends protecting
network access to devices with appropriate mechanisms. To operate the
devices in a protected IT environment, Siemens recommends configuring
the environment according to Siemens'  operational guidelines for industrial security https://www.siemens.com/cert/operational-guidelines-industrial-security
and following the recommendations in the product manuals. Siemens also provides  additional information on industrial security https://www.siemens.com/industrialsecurity .
For further inquiries on security vulnerabilities in Siemens products, users should contact  Siemens https://www.siemens.com/cert/advisories .
For more information, see the associated Siemens security advisory SSA-360681 in  HTML  https://cert-portal.siemens.com/productcert/html/ssa-360681.html and  CSAF https://cert-portal.siemens.com/productcert/csaf/ssa-360681.json .