CVE-2023-0973 - Vulnerability Details - OpenCVE

STEPTools v18SP1 ifcmesh library (v18.1) is affected due to a null pointer dereference, which could allow an attacker to deny application usage when reading a specially constructed file, resulting in an application crash.

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.0004.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Steptools	Ifcmesh Library

Configuration 1 [-]

cpe:2.3:a:steptools:ifcmesh_library:*:*:*:*:*:*:*:*

No data.

No data.

Fixes

Solution

STEPTools has provided an updated version of their software and recommends users update to v18.102. STEPTools requests users contact them via email for assistance with obtaining and applying the update.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://www.cisa.gov/news-events/ics-advisories/icsa-23-068-04

History

Thu, 16 Jan 2025 22:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: icscert

Published: 2023-03-13T17:06:05.431Z

Updated: 2025-01-16T21:55:13.223Z

Reserved: 2023-02-22T22:43:14.108Z

Link: CVE-2023-0973

Vulnrichment

Updated: 2024-08-02T05:32:46.021Z

NVD

Status : Modified

Published: 2023-03-13T18:15:12.683

Modified: 2024-11-21T07:38:12.883

Link: CVE-2023-0973

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-0973", "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "state": "PUBLISHED", "assignerShortName": "icscert", "dateReserved": "2023-02-22T22:43:14.108Z", "datePublished": "2023-03-13T17:06:05.431Z", "dateUpdated": "2025-01-16T21:55:13.223Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "v18SP1 ifcmesh library", "vendor": "Step Tools", "versions": [{"status": "affected", "version": "v18.1"}]}], "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Siemens reported this third-party vulnerability to CISA."}], "datePublic": "2023-03-09T18:00:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "\n\n<span style=\"background-color: rgb(255, 255, 255);\">STEPTools v18SP1 ifcmesh library (v18.1) is affected due to a null pointer dereference, which could allow an attacker to deny application usage when reading a specially constructed file, resulting in an application crash.</span>\n\n"}], "value": "\nSTEPTools v18SP1 ifcmesh library (v18.1) is affected due to a null pointer dereference, which could allow an attacker to deny application usage when reading a specially constructed file, resulting in an application crash.\n\n"}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 2.2, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:L", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-476", "description": "CWE-476 NULL Pointer Dereference", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert", "dateUpdated": "2023-03-13T17:06:05.431Z"}, "references": [{"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-068-04"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "\n\n<span style=\"background-color: rgb(255, 255, 255);\">STEPTools has provided an updated version of their software and recommends users update to v18.102. STEPTools requests users contact them via </span><a target=\"_blank\" rel=\"nofollow\">email</a><span style=\"background-color: rgb(255, 255, 255);\"> for assistance with obtaining and applying the update.</span>\n\n<br>"}], "value": "\nSTEPTools has provided an updated version of their software and recommends users update to v18.102. STEPTools requests users contact them via email\u00a0for assistance with obtaining and applying the update.\n\n\n"}], "source": {"advisory": "ICSA-23-068-04", "discovery": "EXTERNAL"}, "title": "Step Tools Third-Party", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T05:32:46.021Z"}, "title": "CVE Program Container", "references": [{"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-068-04", "tags": ["x_transferred"]}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-01-16T20:21:53.316601Z", "id": "CVE-2023-0973", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-01-16T21:55:13.223Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-068-04", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T05:32:46.021Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-0973", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-01-16T20:21:53.316601Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-01-16T20:21:54.749Z"}}], "cna": {"title": "Step Tools Third-Party", "source": {"advisory": "ICSA-23-068-04", "discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Siemens reported this third-party vulnerability to CISA."}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 2.2, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Step Tools", "product": "v18SP1 ifcmesh library", "versions": [{"status": "affected", "version": "v18.1"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "\nSTEPTools has provided an updated version of their software and recommends users update to v18.102. STEPTools requests users contact them via email\u00a0for assistance with obtaining and applying the update.\n\n\n", "supportingMedia": [{"type": "text/html", "value": "\n\n<span style=\"background-color: rgb(255, 255, 255);\">STEPTools has provided an updated version of their software and recommends users update to v18.102. STEPTools requests users contact them via </span><a target=\"_blank\" rel=\"nofollow\">email</a><span style=\"background-color: rgb(255, 255, 255);\"> for assistance with obtaining and applying the update.</span>\n\n<br>", "base64": false}]}], "datePublic": "2023-03-09T18:00:00.000Z", "references": [{"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-068-04"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "\nSTEPTools v18SP1 ifcmesh library (v18.1) is affected due to a null pointer dereference, which could allow an attacker to deny application usage when reading a specially constructed file, resulting in an application crash.\n\n", "supportingMedia": [{"type": "text/html", "value": "\n\n<span style=\"background-color: rgb(255, 255, 255);\">STEPTools v18SP1 ifcmesh library (v18.1) is affected due to a null pointer dereference, which could allow an attacker to deny application usage when reading a specially constructed file, resulting in an application crash.</span>\n\n", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-476", "description": "CWE-476 NULL Pointer Dereference"}]}], "providerMetadata": {"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert", "dateUpdated": "2023-03-13T17:06:05.431Z"}}}, "cveMetadata": {"cveId": "CVE-2023-0973", "state": "PUBLISHED", "dateUpdated": "2025-01-16T21:55:13.223Z", "dateReserved": "2023-02-22T22:43:14.108Z", "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "datePublished": "2023-03-13T17:06:05.431Z", "assignerShortName": "icscert"}, "dataVersion": "5.1"}