CVE-2020-27003: 
Siemens JT2Go vulnerability analysis and mitigation

A vulnerability (CVE-2020-27003) was identified in JT2Go (All versions < V13.1.0.1) and Teamcenter Visualization (All versions < V13.1.0.1). The vulnerability stems from the applications' lack of proper validation of user-supplied data when parsing TIFF files, which could lead to pointer dereferences of values obtained from untrusted sources (ZDI Advisory, CISA Advisory).

The vulnerability is classified as an Untrusted Pointer Dereference (CWE-822) with a CVSS v3.1 base score of 7.8 HIGH (Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The specific flaw exists within the parsing of TIFF files, where the application fails to properly validate user-supplied data before dereferencing it as a pointer (ZDI Advisory).

An attacker could leverage this vulnerability to execute arbitrary code in the context of the current process. The vulnerability requires user interaction to exploit, as the target must visit a malicious page or open a malicious file (ZDI Advisory).

The vulnerability requires local access and user interaction for successful exploitation. While the vulnerability has been publicly disclosed, there are no known public exploits specifically targeting this vulnerability (CISA Advisory).

Siemens has issued updates to address this vulnerability. Users should update JT2Go and Teamcenter Visualization to version 13.1.0.1 or later. Additionally, Siemens recommends limiting the opening of untrusted files in systems where JT2Go or Teamcenter Visualization is installed and applying defense-in-depth concepts to reduce the probability of untrusted code execution (Siemens Advisory).