CVE-2021-34313: 
Siemens JT2Go vulnerability analysis and mitigation

CVE-2021-34313 is a heap-based buffer overflow vulnerability affecting Siemens JT2Go and Teamcenter Visualization software. The vulnerability was discovered in the Tiff_loader.dll library when parsing TIFF files, and was disclosed on July 13, 2021. The flaw exists due to improper validation of user-supplied data when parsing TIFF files, which could result in an out-of-bounds write past the fixed-length heap-based buffer (CISA, ZDI).

The vulnerability has been assigned a CVSS v3.1 base score of 7.8 (High) with the vector string AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The specific flaw exists within the parsing of TIF files in the Tiff_loader.dll library. The issue stems from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer (ZDI, CISA).

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code in the context of the current process. The vulnerability requires user interaction, as the target must visit a malicious page or open a malicious file for the exploit to be successful (ZDI).

The vulnerability requires local access and user interaction to exploit. While the attack complexity is low, the attacker needs to convince a user to visit a malicious page or open a malicious file. No known public exploits specifically targeting this vulnerability have been reported (CISA).

Siemens has released updates to address this vulnerability. Users should update JT2Go to version 13.2 or later, and Teamcenter Visualization to version 13.2 or later. As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms and configuring the environment according to Siemens' Operational Guidelines for Industrial Security (CISA).