Details of VAR-202303-0903

ID

VAR-202303-0903

CVE

CVE-2023-27399

TITLE

Siemens Tecnomatix Plant Simulation SPP File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

Trust: 1.4

sources: ZDI: ZDI-23-323 // ZDI: ZDI-23-322

DESCRIPTION

A vulnerability has been identified in Tecnomatix Plant Simulation (All versions < V2201.0006). The affected application contains an out of bounds write past the end of an allocated buffer while parsing a specially crafted SPP file. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-20299, ZDI-CAN-20346). Siemens' Tecnomatix Plant Simulation Exists in an out-of-bounds write vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Siemens Tecnomatix Plant Simulation. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the parsing of SPP files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. Siemens Tecnomatix Plant Simulation is an industrial control equipment of German Siemens (Siemens). Leverage the power of discrete event simulation for throughput analysis and optimization to improve manufacturing system performance

Trust: 3.42

sources: NVD: CVE-2023-27399 // JVNDB: JVNDB-2023-004927 // ZDI: ZDI-23-323 // ZDI: ZDI-23-322 // CNVD: CNVD-2023-18930

IOT TAXONOMY

category:

['ICS']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2023-18930

AFFECTED PRODUCTS

vendor:	siemens	model:	tecnomatix plant simulation	scope:	-	version:	-	Trust: 1.4
vendor:	siemens	model:	tecnomatix plant simulation	scope:	lt	version:	2201.0006	Trust: 1.0
vendor:	シーメンス	model:	tecnomatix plant simulation	scope:	eq	version:	-	Trust: 0.8
vendor:	シーメンス	model:	tecnomatix plant simulation	scope:	eq	version:	2201.0006	Trust: 0.8
vendor:	シーメンス	model:	tecnomatix plant simulation	scope:	-	version:	-	Trust: 0.8
vendor:	siemens	model:	tecnomatix plant simulation	scope:	lt	version:	v2201.0006	Trust: 0.6

sources: ZDI: ZDI-23-323 // ZDI: ZDI-23-322 // CNVD: CNVD-2023-18930 // JVNDB: JVNDB-2023-004927 // NVD: CVE-2023-27399

CVSS

SEVERITY

CVSSV2

CVSSV3

NVD:	CVE-2023-27399
value:	HIGH
Trust: 1.8
ZDI:	CVE-2023-27399
value:	HIGH
Trust: 1.4
productcert@siemens.com:	CVE-2023-27399
value:	HIGH
Trust: 1.0
CNVD:	CNVD-2023-18930
value:	HIGH
Trust: 0.6
CNNVD:	CNNVD-202303-1080
value:	HIGH
Trust: 0.6

CNVD:	CNVD-2023-18930
severity:	HIGH
baseScore:	7.2
vectorString:	AV:L/AC:L/AU:N/C:C/I:C/A:C
accessVector:	LOCAL
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	3.9
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6

NVD:
baseSeverity:	HIGH
baseScore:	7.8
vectorString:	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector:	LOCAL
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	REQUIRED
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	1.8
impactScore:	5.9
version:	3.1
Trust: 2.0
ZDI:	CVE-2023-27399
baseSeverity:	HIGH
baseScore:	7.8
vectorString:	AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector:	LOCAL
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	REQUIRED
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	1.8
impactScore:	5.9
version:	3.0
Trust: 1.4
NVD:	CVE-2023-27399
baseSeverity:	HIGH
baseScore:	7.8
vectorString:	CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector:	LOCAL
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	REQUIRED
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: ZDI: ZDI-23-323 // ZDI: ZDI-23-322 // CNVD: CNVD-2023-18930 // JVNDB: JVNDB-2023-004927 // NVD: CVE-2023-27399 // NVD: CVE-2023-27399 // CNNVD: CNNVD-202303-1080

PROBLEMTYPE DATA

problemtype:	CWE-787	Trust: 1.0
problemtype:	Out-of-bounds writing (CWE-787) [ others ]	Trust: 0.8

sources: JVNDB: JVNDB-2023-004927 // NVD: CVE-2023-27399

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-202303-1080

TYPE

buffer error

Trust: 0.6

sources: CNNVD: CNNVD-202303-1080

CONFIGURATIONS

sources: NVD: CVE-2023-27399

PATCH

title:	Siemens has issued an update to correct this vulnerability.	url:	https://cert-portal.siemens.com/productcert/pdf/ssa-847261.pdf	Trust: 1.4
title:	Patch for Siemens Tecnomatix Plant Simulation Out-of-Bounds Write Vulnerability	url:	https://www.cnvd.org.cn/patchinfo/show/415656	Trust: 0.6
title:	Siemens Tecnomatix Plant Simulation Buffer error vulnerability fix	url:	http://123.124.177.30/web/xxk/bdxqbyid.tag?id=228931	Trust: 0.6

sources: ZDI: ZDI-23-323 // ZDI: ZDI-23-322 // CNVD: CNVD-2023-18930 // CNNVD: CNNVD-202303-1080

EXTERNAL IDS

db:	NVD	id:	CVE-2023-27399	Trust: 5.2
db:	SIEMENS	id:	SSA-847261	Trust: 3.0
db:	JVN	id:	JVNVU97514209	Trust: 0.8
db:	JVNDB	id:	JVNDB-2023-004927	Trust: 0.8
db:	ZDI_CAN	id:	ZDI-CAN-20299	Trust: 0.7
db:	ZDI	id:	ZDI-23-323	Trust: 0.7
db:	ZDI_CAN	id:	ZDI-CAN-20346	Trust: 0.7
db:	ZDI	id:	ZDI-23-322	Trust: 0.7
db:	CNVD	id:	CNVD-2023-18930	Trust: 0.6
db:	CNNVD	id:	CNNVD-202303-1080	Trust: 0.6

sources: ZDI: ZDI-23-323 // ZDI: ZDI-23-322 // CNVD: CNVD-2023-18930 // JVNDB: JVNDB-2023-004927 // NVD: CVE-2023-27399 // CNNVD: CNNVD-202303-1080

REFERENCES

url:	https://cert-portal.siemens.com/productcert/pdf/ssa-847261.pdf	Trust: 4.4
url:	https://jvn.jp/vu/jvnvu97514209/	Trust: 0.8
url:	https://nvd.nist.gov/vuln/detail/cve-2023-27399	Trust: 0.8
url:	https://cxsecurity.com/cveshow/cve-2023-27399/	Trust: 0.6

sources: ZDI: ZDI-23-323 // ZDI: ZDI-23-322 // CNVD: CNVD-2023-18930 // JVNDB: JVNDB-2023-004927 // NVD: CVE-2023-27399 // CNNVD: CNNVD-202303-1080

CREDITS

Simon Janz (@esj4y)

Trust: 0.7

sources: ZDI: ZDI-23-323

SOURCES

db:	ZDI	id:	ZDI-23-323
db:	ZDI	id:	ZDI-23-322
db:	CNVD	id:	CNVD-2023-18930
db:	JVNDB	id:	JVNDB-2023-004927
db:	NVD	id:	CVE-2023-27399
db:	CNNVD	id:	CNNVD-202303-1080

LAST UPDATE DATE

2023-12-18T11:20:46.510000+00:00

SOURCES UPDATE DATE

db:	ZDI	id:	ZDI-23-323	date:	2023-03-16T00:00:00
db:	ZDI	id:	ZDI-23-322	date:	2023-03-16T00:00:00
db:	CNVD	id:	CNVD-2023-18930	date:	2023-03-22T00:00:00
db:	JVNDB	id:	JVNDB-2023-004927	date:	2023-11-02T07:35:00
db:	NVD	id:	CVE-2023-27399	date:	2023-03-16T19:02:02.340
db:	CNNVD	id:	CNNVD-202303-1080	date:	2023-03-15T00:00:00

SOURCES RELEASE DATE

db:	ZDI	id:	ZDI-23-323	date:	2023-03-16T00:00:00
db:	ZDI	id:	ZDI-23-322	date:	2023-03-16T00:00:00
db:	CNVD	id:	CNVD-2023-18930	date:	2023-03-22T00:00:00
db:	JVNDB	id:	JVNDB-2023-004927	date:	2023-11-02T00:00:00
db:	NVD	id:	CVE-2023-27399	date:	2023-03-14T10:15:28.963
db:	CNNVD	id:	CNNVD-202303-1080	date:	2023-03-14T00:00:00