CVE-2023-0973 - Vulnerability Details - OpenCVE

Description

STEPTools v18SP1 ifcmesh library (v18.1) is affected due to a null pointer dereference, which could allow an attacker to deny application usage when reading a specially constructed file, resulting in an application crash.

Published: 2023-03-13

Score: 2.2 Low

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

No analysis available yet.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Step Tools

v18SP1 ifcmesh library

unaffected

Version	Status	Constraints
`v18.1`	affected	—

Configuration 1 [-]

cpe:2.3:a:steptools:ifcmesh_library:*:*:*:*:*:*:*:*

No data.

No data available yet.

Remediation

Vendor Solution

STEPTools has provided an updated version of their software and recommends users update to v18.102. STEPTools requests users contact them via email for assistance with obtaining and applying the update.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
EUVD	EUVD-2023-12958	STEPTools v18SP1 ifcmesh library (v18.1) is affected due to a null pointer dereference, which could allow an attacker to deny application usage when reading a specially constructed file, resulting in an application crash.

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00031.

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://www.cisa.gov/news-events/ics-advisories/icsa-23-068-04

History

Thu, 16 Jan 2025 22:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Subscriptions

Steptools Ifcmesh Library

MITRE

Status: PUBLISHED

Assigner: icscert

Published: 2023-03-13T17:06:05.431Z

Updated: 2025-01-16T21:55:13.223Z

Reserved: 2023-02-22T22:43:14.108Z

Link: CVE-2023-0973

Vulnrichment

Updated: 2024-08-02T05:32:46.021Z

NVD

Status : Modified

Published: 2023-03-13T18:15:12.683

Modified: 2024-11-21T07:38:12.883

Link: CVE-2023-0973

Redhat

No data.

OpenCVE Enrichment

No data.

Weaknesses

CWE-476

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-0973", "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "state": "PUBLISHED", "assignerShortName": "icscert", "dateReserved": "2023-02-22T22:43:14.108Z", "datePublished": "2023-03-13T17:06:05.431Z", "dateUpdated": "2025-01-16T21:55:13.223Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "v18SP1 ifcmesh library", "vendor": "Step Tools", "versions": [{"status": "affected", "version": "v18.1"}]}], "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Siemens reported this third-party vulnerability to CISA."}], "datePublic": "2023-03-09T18:00:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "\n\n<span style=\"background-color: rgb(255, 255, 255);\">STEPTools v18SP1 ifcmesh library (v18.1) is affected due to a null pointer dereference, which could allow an attacker to deny application usage when reading a specially constructed file, resulting in an application crash.</span>\n\n"}], "value": "\nSTEPTools v18SP1 ifcmesh library (v18.1) is affected due to a null pointer dereference, which could allow an attacker to deny application usage when reading a specially constructed file, resulting in an application crash.\n\n"}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 2.2, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:L", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-476", "description": "CWE-476 NULL Pointer Dereference", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert", "dateUpdated": "2023-03-13T17:06:05.431Z"}, "references": [{"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-068-04"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "\n\n<span style=\"background-color: rgb(255, 255, 255);\">STEPTools has provided an updated version of their software and recommends users update to v18.102. STEPTools requests users contact them via </span><a target=\"_blank\" rel=\"nofollow\">email</a><span style=\"background-color: rgb(255, 255, 255);\"> for assistance with obtaining and applying the update.</span>\n\n<br>"}], "value": "\nSTEPTools has provided an updated version of their software and recommends users update to v18.102. STEPTools requests users contact them via email\u00a0for assistance with obtaining and applying the update.\n\n\n"}], "source": {"advisory": "ICSA-23-068-04", "discovery": "EXTERNAL"}, "title": "Step Tools Third-Party", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T05:32:46.021Z"}, "title": "CVE Program Container", "references": [{"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-068-04", "tags": ["x_transferred"]}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-01-16T20:21:53.316601Z", "id": "CVE-2023-0973", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-01-16T21:55:13.223Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-068-04", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T05:32:46.021Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-0973", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-01-16T20:21:53.316601Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-01-16T20:21:54.749Z"}}], "cna": {"title": "Step Tools Third-Party", "source": {"advisory": "ICSA-23-068-04", "discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Siemens reported this third-party vulnerability to CISA."}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 2.2, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Step Tools", "product": "v18SP1 ifcmesh library", "versions": [{"status": "affected", "version": "v18.1"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "\nSTEPTools has provided an updated version of their software and recommends users update to v18.102. STEPTools requests users contact them via email\u00a0for assistance with obtaining and applying the update.\n\n\n", "supportingMedia": [{"type": "text/html", "value": "\n\n<span style=\"background-color: rgb(255, 255, 255);\">STEPTools has provided an updated version of their software and recommends users update to v18.102. STEPTools requests users contact them via </span><a target=\"_blank\" rel=\"nofollow\">email</a><span style=\"background-color: rgb(255, 255, 255);\"> for assistance with obtaining and applying the update.</span>\n\n<br>", "base64": false}]}], "datePublic": "2023-03-09T18:00:00.000Z", "references": [{"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-068-04"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "\nSTEPTools v18SP1 ifcmesh library (v18.1) is affected due to a null pointer dereference, which could allow an attacker to deny application usage when reading a specially constructed file, resulting in an application crash.\n\n", "supportingMedia": [{"type": "text/html", "value": "\n\n<span style=\"background-color: rgb(255, 255, 255);\">STEPTools v18SP1 ifcmesh library (v18.1) is affected due to a null pointer dereference, which could allow an attacker to deny application usage when reading a specially constructed file, resulting in an application crash.</span>\n\n", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-476", "description": "CWE-476 NULL Pointer Dereference"}]}], "providerMetadata": {"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert", "dateUpdated": "2023-03-13T17:06:05.431Z"}}}, "cveMetadata": {"cveId": "CVE-2023-0973", "state": "PUBLISHED", "dateUpdated": "2025-01-16T21:55:13.223Z", "dateReserved": "2023-02-22T22:43:14.108Z", "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "datePublished": "2023-03-13T17:06:05.431Z", "assignerShortName": "icscert"}, "dataVersion": "5.1"}