CVE-2021-38405

Summary

The Datalogics APDFL library used in affected products is vulnerable to memory corruption condition while parsing specially crafted PDF files. An attacker could leverage this vulnerability to execute code in the context of the current process.

Affected Software

VendorProductVersion RangeStatus
SiemensJT2Go0 < 13.2.0.7affected
SiemensTeamcenter Visualization12.4 < 12.4.0.13affected
SiemensTeamcenter Visualization13.1 < 13.1.0.8affected
SiemensTeamcenter Visualization13.2 < 13.2.0.7affected
SiemensTeamcenter Visualization13.3 < 13.3.0.1affected

Weaknesses

  • CWE-119: CWE-119

Workarounds

Siemens has identified the following specific workarounds and mitigations users can apply to reduce the risk:

  • Avoid opening untrusted files from unknown sources in affected products.

As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens’ operational guidelines for industrial security https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf , and to follow the recommendations in the product manuals.

Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage https://www.siemens.com/industrialsecurity .

Please see Siemens security advisory SSA-301589 https://cert-portal.siemens.com/productcert/pdf/ssa-301589.pdf  for more information.

ADP Enrichment

CVE Program Container

Additional References

References