The version of Siemens JT2Go installed on the remote Windows hosts is prior to 13.2.0.1. It is, therefore, affected by multiple vulnerabilities, including the following:

  - An out-of-bounds write issue exists in the DXF file-recovering procedure in the Drawings SDK     resulting from the lack of proper validation of user-supplied data. This can result in a write past     the end of an allocated buffer and allow attackers to cause a denial-of-service condition or execute     code in the context of the current process. (CVE-2021-32936)

  - A use-after-free issue exists in the DGN file-reading procedure in the Open Design Alliance Drawings     SDK (All versions prior to 2022.4) resulting from the lack of proper validation of user-supplied data.
    This can result in a memory corruption or arbitrary code execution, allowing attackers to cause a     denial-of-service condition or execute code in the context of the current process. (CVE-2021-32944)

  - An out-of-bounds write issue exists in the DWG file-reading procedure in the Open Design Alliance     Drawings SDK (All versions prior to 2022.4) resulting from the lack of proper validation of user-supplied     data. This can result in a write past the end of an allocated buffer and allow attackers to cause a     denial-of-service condition or execute code in the context of the current process. (CVE-2021-32948)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Detections

Analytics

Siemens JT2Go < 13.2.0.1 Multiple Vulnerabilities (SSA-365397)

high Nessus Plugin ID 152522

Version 1.5