CVE-2021-34299: 
Siemens JT2Go vulnerability analysis and mitigation

The vulnerability (CVE-2021-34299) is a buffer over-read vulnerability affecting Siemens JT2Go software. It was discovered in the Tiff_loader.dll library when parsing TIFF files. The issue was reported on March 12, 2021, and publicly disclosed on July 19, 2021. The vulnerability affects all versions of JT2Go prior to v13.2 (ZDI Advisory, CISA Advisory).

The vulnerability is classified as a Buffer Over-read (CWE-126) issue that exists within the parsing of TIF files. The specific flaw results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. The vulnerability has been assigned a CVSS v3 base score of 3.3, with the vector string (AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) indicating local access required and low severity (ZDI Advisory).

If successfully exploited, this vulnerability could allow an attacker to disclose sensitive information in the context of the current process. The impact is limited to information disclosure, with no direct impact on system integrity or availability (CISA Advisory).

Siemens has released version 13.2 of JT2Go to address this vulnerability. Users are recommended to update to this version. As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms and configuring the environment according to Siemens' Operational Guidelines for Industrial Security (CISA Advisory).