CVE-2021-25175

Vulnerability

The vulnerability is a type conversion issue in the Open Design Alliance Drawings SDK prior to version 2021.11. When rendering malformed .DXF or .DWG files, the SDK fails to properly validate user-supplied data, leading to a write past the end of an allocated buffer. This affects all versions before 2021.11. The issue is present in the DXF/DWG parsing component. [1][2][3][4]

Exploitation

An attacker can exploit this by crafting a malicious .DXF or .DWG file and convincing a user to open it with an application that uses the vulnerable SDK, such as Siemens JT2Go. No authentication is required, but user interaction is necessary. The attacker does not need any special network position; the file can be delivered via email, web download, etc. The specific flaw is triggered during parsing of the malformed file, causing an out-of-bounds write. [2][3][4]

Impact

Successful exploitation allows an attacker to execute arbitrary code in the context of the current process. This can lead to complete compromise of the affected system, including confidentiality, integrity, and availability. The CVSS score is 7.8 (High). [2][3][4]

Mitigation

The vendor, Open Design Alliance, fixed the issue in Drawings SDK version 2021.11. Users should update to that version or later. For Siemens JT2Go, users should apply the latest updates from Siemens. No workarounds are mentioned in the references. [1][2][3][4]