SB2021072004 - Multiple vulnerabilities in Siemens JT Utilities

Description

This security bulletin contains information about 3 secuirty vulnerabilities.

1) Function Call With Incorrect Variable or Reference as Argument (CVE-ID: CVE-2021-33713)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a hash function is called with an incorrect argument when parsing specially crafted JT files. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

2) NULL pointer dereference (CVE-ID: CVE-2021-33714)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error when parsing specially crafted JT files. A remote attacker can pass specially crafted data to the application and perform a denial of service (DoS) attack.

3) NULL pointer dereference (CVE-ID: CVE-2021-33715)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error when parsing specially crafted JT files. A remote attacker can pass specially crafted data to the application and perform a denial of service (DoS) attack.

Remediation

Install update from vendor's website.

References

• https://cert-portal.siemens.com/productcert/pdf/ssa-209268.pdf