Vulnerability-Lookup

FKIE_CVE-2021-27035

Vulnerability from fkie_nvd - Published: 2021-07-09 15:15 - Updated: 2024-11-21 05:57

Severity ?

7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Summary

A maliciously crafted TIFF, TIF, PICT, TGA, or DWF files in Autodesk Design Review 2018, 2017, 2013, 2012, 2011 can be forced to read beyond allocated boundaries when parsing the TIFF, PICT, TGA or DWF files. This vulnerability in conjunction with other vulnerabilities could lead to code execution in the context of the current process.

References

	URL	Tags
	psirt@autodesk.com	https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0004	Patch, Vendor Advisory
	af854a3a-2127-422b-91ae-364da2661108	https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0004	Patch, Vendor Advisory

Impacted products

Vendor	Product	Version
autodesk	design_review	2011
autodesk	design_review	2012
autodesk	design_review	2013
autodesk	design_review	2017
autodesk	design_review	2018
autodesk	design_review	2018
autodesk	design_review	2018
autodesk	design_review	2018

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:autodesk:design_review:2011:*:*:*:*:*:*:*",
              "matchCriteriaId": "83CF6CDF-806C-4DC5-B572-C1C2BC2C25F2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:autodesk:design_review:2012:*:*:*:*:*:*:*",
              "matchCriteriaId": "2A78B6F8-DF84-4E6C-A247-0F6D2F8CA679",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:autodesk:design_review:2013:*:*:*:*:*:*:*",
              "matchCriteriaId": "DCD2CA9B-16E1-4BE7-A4E1-A9817A503958",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:autodesk:design_review:2017:*:*:*:*:*:*:*",
              "matchCriteriaId": "31F2529F-ECF0-4568-BBDC-82B396A52332",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:autodesk:design_review:2018:-:*:*:*:*:*:*",
              "matchCriteriaId": "213232B9-A40B-436D-A66A-B65C49D59BE6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:autodesk:design_review:2018:hotfix:*:*:*:*:*:*",
              "matchCriteriaId": "2D0CF4DC-ACA5-41D0-B28E-CEB5D2C96F71",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:autodesk:design_review:2018:hotfix2:*:*:*:*:*:*",
              "matchCriteriaId": "84ED1789-A17F-48F7-A152-09D2A5C59254",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:autodesk:design_review:2018:hotfix3:*:*:*:*:*:*",
              "matchCriteriaId": "74819924-EB63-4BBF-9986-FEF6100EEE15",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A maliciously crafted TIFF, TIF, PICT, TGA, or DWF files in Autodesk Design Review 2018, 2017, 2013, 2012, 2011 can be forced to read beyond allocated boundaries when parsing the TIFF, PICT, TGA or DWF files. This vulnerability in conjunction with other vulnerabilities could lead to code execution in the context of the current process."
    },
    {
      "lang": "es",
      "value": "Un archivo TIFF, TIF, PICT, TGA o DWF malintencionado en Autodesk Design Review 2018, 2017, 2013, 2012, 2011 puede ser forzado a leer m\u00e1s all\u00e1 de los l\u00edmites asignados al analizar los archivos TIFF, PICT, TGA o DWF. Esta vulnerabilidad en conjunto con otras vulnerabilidades podr\u00eda llevar a la ejecuci\u00f3n de c\u00f3digo en el contexto del proceso actual"
    }
  ],
  "id": "CVE-2021-27035",
  "lastModified": "2024-11-21T05:57:13.320",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 6.8,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2021-07-09T15:15:07.877",
  "references": [
    {
      "source": "psirt@autodesk.com",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0004"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0004"
    }
  ],
  "sourceIdentifier": "psirt@autodesk.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-787"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

CVE-2021-27035 (GCVE-0-2021-27035)

Vulnerability from cvelistv5 – Published: 2021-07-09 14:16 – Updated: 2024-08-03 20:40

Summary

Severity ?

No CVSS data available.

CWE

Out-of-bounds Read

Assigner

autodesk

References

URL

Tags

https://www.autodesk.com/trust/security-advisorie…

x_refsource_MISC

Impacted products

	Vendor	Product	Version
	n/a	Autodesk Design Review	Affected: 2018, 2017, 2013, 2012, 2011

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T20:40:47.068Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0004"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Autodesk Design Review",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "2018,\u00a02017,\u00a02013, 2012, 2011"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A maliciously crafted TIFF, TIF, PICT, TGA, or DWF files in Autodesk Design Review 2018, 2017, 2013, 2012, 2011 can be forced to read beyond allocated boundaries when parsing the TIFF, PICT, TGA or DWF files. This vulnerability in conjunction with other vulnerabilities could lead to code execution in the context of the current process."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Out-of-bounds Read",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-04-18T16:20:49.000Z",
        "orgId": "7e40ea87-bc65-4944-9723-dd79dd760601",
        "shortName": "autodesk"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0004"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "psirt@autodesk.com",
          "ID": "CVE-2021-27035",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Autodesk Design Review",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "2018,\u00a02017,\u00a02013, 2012, 2011"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A maliciously crafted TIFF, TIF, PICT, TGA, or DWF files in Autodesk Design Review 2018, 2017, 2013, 2012, 2011 can be forced to read beyond allocated boundaries when parsing the TIFF, PICT, TGA or DWF files. This vulnerability in conjunction with other vulnerabilities could lead to code execution in the context of the current process."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Out-of-bounds Read"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0004",
              "refsource": "MISC",
              "url": "https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0004"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7e40ea87-bc65-4944-9723-dd79dd760601",
    "assignerShortName": "autodesk",
    "cveId": "CVE-2021-27035",
    "datePublished": "2021-07-09T14:16:34.000Z",
    "dateReserved": "2021-02-09T00:00:00.000Z",
    "dateUpdated": "2024-08-03T20:40:47.068Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

FKIE_CVE-2021-27035

CVE-2021-27035 (GCVE-0-2021-27035)

Tags

Sightings

Nomenclature