CVE-2021-34315
📋 TL;DR
This vulnerability allows attackers to execute arbitrary code by exploiting an out-of-bounds read in the BMP_loader.dll library when parsing malicious SGI files in Siemens JT2Go and Teamcenter Visualization software. Users of these applications with versions below 13.2 are affected. Successful exploitation could lead to complete system compromise.
💻 Affected Systems
- Siemens JT2Go
- Siemens Teamcenter Visualization
📦 What is this software?
Jt2go by Siemens
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution with SYSTEM/root privileges leading to complete system takeover, data exfiltration, and lateral movement within the network.
Likely Case
Local privilege escalation or remote code execution in the context of the current user, potentially leading to malware installation or data theft.
If Mitigated
Denial of service or application crash if exploit fails or is blocked by security controls.
🎯 Exploit Status
Exploitation requires user interaction to open a malicious SGI file. The vulnerability is an out-of-bounds read that could lead to code execution, but crafting a reliable exploit requires specific knowledge of memory layout.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: V13.2 or later
Vendor Advisory: https://cert-portal.siemens.com/productcert/pdf/ssa-483182.pdf
Restart Required: Yes
Instructions:
1. Download and install JT2Go V13.2 or later from Siemens support portal. 2. Download and install Teamcenter Visualization V13.2 or later from Siemens support portal. 3. Restart affected systems after installation.
🔧 Temporary Workarounds
Block SGI file extensions
windowsPrevent opening of SGI files by blocking the file extension at the system or network level.
Windows Group Policy: Computer Configuration > Policies > Windows Settings > Security Settings > Software Restriction Policies > Additional Rules > New Path Rule: Path: *.sgi, Security Level: Disallowed
Disable BMP_loader.dll for SGI files
windowsRemove or rename the BMP_loader.dll file to prevent SGI file parsing (may affect other functionality).
rename "C:\Program Files\Siemens\JT2Go\BMP_loader.dll" "BMP_loader.dll.bak"
rename "C:\Program Files\Siemens\Teamcenter Visualization\BMP_loader.dll" "BMP_loader.dll.bak"
🧯 If You Can't Patch
- Restrict user permissions to prevent execution of untrusted SGI files.
- Implement application whitelisting to block unauthorized execution of JT2Go and Teamcenter Visualization.
🔍 How to Verify
Check if Vulnerable:
Check application version in Help > About menu. If version is below 13.2, the system is vulnerable.Check Version:
wmic product where "name like '%JT2Go%' or name like '%Teamcenter Visualization%'" get name, versionVerify Fix Applied:
Verify version is 13.2 or higher in Help > About menu and test opening legitimate SGI files to ensure functionality.📡 Detection & Monitoring
Log Indicators:
- Application crashes with access violation errors in BMP_loader.dll
- Windows Event Logs: Application Error events for JT2Go.exe or Teamcenter Visualization processes
Network Indicators:
- Downloads of SGI files from untrusted sources
- Unusual outbound connections from JT2Go/Teamcenter Visualization processes
SIEM Query:
source="windows" AND (event_id=1000 OR event_id=1001) AND process_name IN ("JT2Go.exe", "Teamcenter Visualization") AND module_name="BMP_loader.dll"