A vulnerability has been identified in Simcenter Femap V2020.2 (All versions), Simcenter Femap V2021.1 (All versions). Affected application contains a stack based buffer overflow vulnerability while parsing NEU files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-15085, ZDI-CAN-15289, ZDI-CAN-15602)
A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).
The product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties.
| Link | Tags |
|---|---|
| https://cert-portal.siemens.com/productcert/pdf/ssa-609880.pdf | vendor advisory |
| https://www.zerodayinitiative.com/advisories/ZDI-22-311/ | third party advisory vdb entry |
| https://www.zerodayinitiative.com/advisories/ZDI-22-312/ | third party advisory vdb entry |
| https://www.zerodayinitiative.com/advisories/ZDI-22-313/ | third party advisory vdb entry |