Sign-up

ID

VAR-202109-0544


CVE

CVE-2021-25665


TITLE

Simcenter STAR-CCM+ Viewer  Out-of-bounds write vulnerability in

Trust: 0.8

sources: JVNDB: JVNDB-2021-011721

DESCRIPTION

A vulnerability has been identified in Simcenter STAR-CCM+ Viewer (All versions < V2021.2.1). The starview+.exe application lacks proper validation of user-supplied data when parsing scene files. This could result in an out of bounds write past the end of an allocated structure. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-13700). Zero Day Initiative To this vulnerability ZDI-CAN-13700 Was numbering.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the parsing of SCE files. Pillow is a Python-based image processing library. There is currently no information about this vulnerability, please feel free to follow CNNVD or manufacturer announcements

Trust: 2.88

sources: NVD: CVE-2021-25665 // JVNDB: JVNDB-2021-011721 // ZDI: ZDI-21-1074 // CNNVD: CNNVD-202104-975 // VULMON: CVE-2021-25665

AFFECTED PRODUCTS

vendor:siemensmodel:simcenter star-ccm\+scope:ltversion:2021.2.1

Trust: 1.0

vendor:シーメンスmodel:simcenter star-ccm+ viewerscope:eqversion: -

Trust: 0.8

vendor:シーメンスmodel:simcenter star-ccm+ viewerscope:eqversion:simcenter star-ccm+ 2021/2/1 before that

Trust: 0.8

vendor:siemensmodel:simcenter star-ccm+scope: - version: -

Trust: 0.7

sources: ZDI: ZDI-21-1074 // JVNDB: JVNDB-2021-011721 // NVD: CVE-2021-25665

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2021-25665
value: HIGH

Trust: 1.0

NVD: CVE-2021-25665
value: HIGH

Trust: 0.8

ZDI: CVE-2021-25665
value: HIGH

Trust: 0.7

CNNVD: CNNVD-202104-975
value: MEDIUM

Trust: 0.6

CNNVD: CNNVD-202109-950
value: HIGH

Trust: 0.6

VULMON: CVE-2021-25665
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2021-25665
severity: MEDIUM
baseScore: 6.8
vectorString: AV:N/AC:M/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 8.6
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

nvd@nist.gov: CVE-2021-25665
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 1.8
impactScore: 5.9
version: 3.1

Trust: 1.0

NVD: CVE-2021-25665
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

ZDI: CVE-2021-25665
baseSeverity: HIGH
baseScore: 7.8
vectorString: AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 1.8
impactScore: 5.9
version: 3.0

Trust: 0.7

sources: ZDI: ZDI-21-1074 // VULMON: CVE-2021-25665 // JVNDB: JVNDB-2021-011721 // CNNVD: CNNVD-202104-975 // CNNVD: CNNVD-202109-950 // NVD: CVE-2021-25665

PROBLEMTYPE DATA

problemtype:CWE-787

Trust: 1.0

problemtype:Out-of-bounds writing (CWE-787) [ others ]

Trust: 0.8

sources: JVNDB: JVNDB-2021-011721 // NVD: CVE-2021-25665

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-202109-950

TYPE

other

Trust: 0.6

sources: CNNVD: CNNVD-202104-975

PATCH

title:SSA-109294url:https://cert-portal.siemens.com/productcert/pdf/ssa-109294.pdf

Trust: 0.8

title:Siemens has issued an update to correct this vulnerability.url:https://us-cert.cisa.gov/ics/advisories/icsa-21-257-05

Trust: 0.7

title:Simcenter STAR-CCM+ Viewer Buffer error vulnerability fixurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=162485

Trust: 0.6

title:Siemens Security Advisories: Siemens Security Advisoryurl:https://vulmon.com/vendoradvisory?qidtp=siemens_security_advisories&qid=eacbd403efe110a581b92ebe3b40bdaa

Trust: 0.1

sources: ZDI: ZDI-21-1074 // VULMON: CVE-2021-25665 // JVNDB: JVNDB-2021-011721 // CNNVD: CNNVD-202109-950

EXTERNAL IDS

db:NVDid:CVE-2021-25665

Trust: 4.0

db:ZDIid:ZDI-21-1074

Trust: 3.2

db:SIEMENSid:SSA-109294

Trust: 1.7

db:ICS CERTid:ICSA-21-257-05

Trust: 1.4

db:JVNid:JVNVU96712416

Trust: 0.8

db:JVNDBid:JVNDB-2021-011721

Trust: 0.8

db:ZDI_CANid:ZDI-CAN-13700

Trust: 0.7

db:CS-HELPid:SB2021041363

Trust: 0.6

db:CNNVDid:CNNVD-202104-975

Trust: 0.6

db:CS-HELPid:SB2021091513

Trust: 0.6

db:AUSCERTid:ESB-2021.3097

Trust: 0.6

db:CNNVDid:CNNVD-202109-950

Trust: 0.6

db:VULMONid:CVE-2021-25665

Trust: 0.1

sources: ZDI: ZDI-21-1074 // VULMON: CVE-2021-25665 // JVNDB: JVNDB-2021-011721 // CNNVD: CNNVD-202104-975 // CNNVD: CNNVD-202109-950 // NVD: CVE-2021-25665

REFERENCES

url:https://www.zerodayinitiative.com/advisories/zdi-21-1074/

Trust: 3.2

url:https://cert-portal.siemens.com/productcert/pdf/ssa-109294.pdf

Trust: 1.7

url:https://nvd.nist.gov/vuln/detail/cve-2021-25665

Trust: 1.4

url:https://us-cert.cisa.gov/ics/advisories/icsa-21-257-05

Trust: 1.3

url:https://jvn.jp/vu/jvnvu96712416/index.html

Trust: 0.8

url:https://www.cisa.gov/uscert/ics/advisories/icsa-21-257-05

Trust: 0.8

url:https://www.cybersecurity-help.cz/vdb/sb2021041363

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2021091513

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2021.3097

Trust: 0.6

url:https://cwe.mitre.org/data/definitions/787.html

Trust: 0.1

url:https://nvd.nist.gov

Trust: 0.1

url:https://cert-portal.siemens.com/productcert/txt/ssa-109294.txt

Trust: 0.1

sources: ZDI: ZDI-21-1074 // VULMON: CVE-2021-25665 // JVNDB: JVNDB-2021-011721 // CNNVD: CNNVD-202104-975 // CNNVD: CNNVD-202109-950 // NVD: CVE-2021-25665

CREDITS

Francis Provencher {PRL}

Trust: 1.3

sources: ZDI: ZDI-21-1074 // CNNVD: CNNVD-202109-950

SOURCES

db:ZDIid:ZDI-21-1074
db:VULMONid:CVE-2021-25665
db:JVNDBid:JVNDB-2021-011721
db:CNNVDid:CNNVD-202104-975
db:CNNVDid:CNNVD-202109-950
db:NVDid:CVE-2021-25665

LAST UPDATE DATE

2024-08-14T12:15:45.402000+00:00


SOURCES UPDATE DATE

db:ZDIid:ZDI-21-1074date:2021-09-15T00:00:00
db:VULMONid:CVE-2021-25665date:2021-09-23T00:00:00
db:JVNDBid:JVNDB-2021-011721date:2022-08-09T06:52:00
db:CNNVDid:CNNVD-202104-975date:2021-04-14T00:00:00
db:CNNVDid:CNNVD-202109-950date:2021-09-24T00:00:00
db:NVDid:CVE-2021-25665date:2021-09-23T17:00:46.317

SOURCES RELEASE DATE

db:ZDIid:ZDI-21-1074date:2021-09-15T00:00:00
db:VULMONid:CVE-2021-25665date:2021-09-14T00:00:00
db:JVNDBid:JVNDB-2021-011721date:2022-08-09T00:00:00
db:CNNVDid:CNNVD-202104-975date:2021-04-13T00:00:00
db:CNNVDid:CNNVD-202109-950date:2021-09-14T00:00:00
db:NVDid:CVE-2021-25665date:2021-09-14T11:15:22.023