QID 591412

QID 591412: Siemens Simcenter STAR-CCM+ Information Disclosure Vulnerability (SSA-555707)

AFFECTED PRODUCTS
The following versions of Simcenter STAR-CCM+ Viewer, a computational fluid dynamics software, are affected:
Simcenter STAR-CCM+ Viewer: All versions are affected

QID Detection Logic (Authenticated):
QID checks for the Vulnerable version of Siemens using registry " HKLM\SOFTWARE\ uninstall string for siemens

Successful exploitation of this vulnerability can lead to the disclosure of sensitive information.

CVSS V3 rated as High - 7.5 severity.

CVSS V2 rated as Medium - 5 severity.

Solution

Customers are advised to refer to CERT MITIGATIONS section SSA-555707 for affected packages and patching details.Workaround:
The vendor has advised the following workarounds:
1. Set the environmental variable STARLICENSEHIDE to 1. This will send the string "unknown" for the user, host, and display name instead of the real values. The setting is supported since version V8.04 (June 2013) of Simcenter STAR-CCM+ 2. Avoid using sensitive or personal data in user, host, and display names.

Vendor References

SSA-555707 - cert-portal.siemens.com/productcert/html/ssa-555707.html

CVEs related to QID 591412

CVE-2022-34659 |

Software Advisories

Advisory ID	Software	Component	Link

By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].