Vulnerabilities > CVE-2020-7083 - Integer Overflow or Wraparound vulnerability in Autodesk FBX Software Development KIT 2019.0

047910
CVSS 4.3 - MEDIUM
Attack vector
NETWORK
Attack complexity
MEDIUM
Privileges required
NONE
Confidentiality impact
NONE
Integrity impact
NONE
Availability impact
PARTIAL
network
autodesk
CWE-190
nessus

Summary

An intager overflow vulnerability in the Autodesk FBX-SDK versions 2019.0 and earlier may lead to denial of service of the application.

Vulnerable Configurations

Part Description Count
Application
Autodesk
1

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Forced Integer Overflow
    This attack forces an integer variable to go out of range. The integer variable is often used as an offset such as size of memory allocation or similarly. The attacker would typically control the value of such variable and try to get it out of range. For instance the integer in question is incremented past the maximum possible value, it may wrap to become a very small, or negative number, therefore providing a very incorrect value which can lead to unexpected behavior. At worst the attacker can execute arbitrary code.

Nessus

  • NASL familyWindows
    NASL idAUTODESK_FBX-SDK_ADSK-SA-2020-0002.NASL
    descriptionThe version of Autodesk FBX-SDK library installed on the remote host is prior to 2019.5. It is, therefore, affected by the following vulnerabilities : - A buffer overflow vulnerability in the Autodesk FBX-SDK may lead to arbitrary code execution on a system running it. (CVE-2020-7080) - A type confusion vulnerability in the Autodesk FBX-SDK may lead to arbitary code read/write on the system running it. (CVE-2020-7081) - A use-after-free vulnerability in the Autodesk FBX-SDK may lead to code execution on a system running it. (CVE-2020-7082) - An intager overflow vulnerability in the Autodesk FBX-SDK may lead to denial of service of the application. (CVE-2020-7083) - A NULL pointer dereference vulnerability in the Autodesk FBX-SDK may lead to denial of service of the application. (CVE-2020-7084) - A heap overflow vulnerability in the Autodesk FBX-SDK may lead to arbitrary code execution on a system running it. (CVE-2020-7085) Note that Nessus has not tested for this issue but has instead relied only on the application
    last seen2020-04-30
    modified2020-04-24
    plugin id135973
    published2020-04-24
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/135973
    titleAutodesk FBX-SDK library <= 2019.5 Multiple Vulnerabilities (ADSK-SA-2020-0002)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include('compat.inc');
    
    if (description)
    {
      script_id(135973);
      script_version("1.2");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/04/27");
    
      script_cve_id(
        "CVE-2020-7080",
        "CVE-2020-7081",
        "CVE-2020-7082",
        "CVE-2020-7083",
        "CVE-2020-7084",
        "CVE-2020-7085"
      );
      script_xref(name:"IAVA", value:"2020-A-0170");
    
      script_name(english:"Autodesk FBX-SDK library <= 2019.5 Multiple Vulnerabilities (ADSK-SA-2020-0002)");
    
      script_set_attribute(attribute:"synopsis", value:
    "The Autodesk FBX-SDK library installed on the remote host is affected by multiple vulnerabilities.");
      script_set_attribute(attribute:"description", value:
    "The version of Autodesk FBX-SDK library installed on the remote host is prior to 2019.5. It is, therefore, affected by
    the following vulnerabilities :
    
      - A buffer overflow vulnerability in the Autodesk FBX-SDK may lead to arbitrary code execution on a system
        running it. (CVE-2020-7080)
    
      - A type confusion vulnerability in the Autodesk FBX-SDK may lead to arbitary code read/write on the system
        running it. (CVE-2020-7081)
    
      - A use-after-free vulnerability in the Autodesk FBX-SDK may lead to code execution on a system running it.
        (CVE-2020-7082)
    
      - An intager overflow vulnerability in the Autodesk FBX-SDK may lead to denial of service of the
        application. (CVE-2020-7083)
    
      - A NULL pointer dereference vulnerability in the Autodesk FBX-SDK may lead to denial of service of the
        application. (CVE-2020-7084)
    
      - A heap overflow vulnerability in the Autodesk FBX-SDK may lead to arbitrary code execution on a system
        running it. (CVE-2020-7085)
    
    Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
    number.");
      script_set_attribute(attribute:"see_also", value:"https://www.autodesk.com/trust/security-advisories/adsk-sa-2020-0002");
      script_set_attribute(attribute:"solution", value:
    "Upgrade to Autodesk FBX-SDK library version 2020 or later.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2020-7085");
    
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2020/04/15");
      script_set_attribute(attribute:"patch_publication_date", value:"2020/04/15");
      script_set_attribute(attribute:"plugin_publication_date", value:"2020/04/24");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"x-cpe:/a:autodesk:fbx_sdk");
      script_set_attribute(attribute:"stig_severity", value:"I");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"Windows");
    
      script_copyright(english:"This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
    
      script_dependencies("autodesk_fbx-sdk_detect_win.nbin");
      script_require_keys("installed_sw/FBX SDK");
    
      exit(0);
    }
    
    include('vcf.inc');
    
    app_info = vcf::get_app_info(app:'FBX SDK');
    
    constraints = [
      { 'max_version' : '2019.5', 'fixed_version' : '2020' }
    ];
    
    vcf::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_HOLE);
    
  • NASL familyWindows : Microsoft Bulletins
    NASL idSMB_NT_MS20_MAR_OFFICE.NASL
    descriptionThe Microsoft Office Products are missing security updates. It is, therefore, affected by multiple vulnerabilities : - A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory. An attacker who successfully exploited the vulnerability could use a specially crafted file to perform actions in the security context of the current user. For example, the file could then take actions on behalf of the logged-on user with the same permissions as the current user. (CVE-2020-0850, CVE-2020-0851, CVE-2020-0855, CVE-2020-0892) - A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory. An attacker who successfully exploited the vulnerability could use a specially crafted file to perform actions in the security context of the current user. For example, the file could then take actions on behalf of the logged-on user with the same permissions as the current user. (CVE-2020-0852) - Remote code execution vulnerabilities exist in Microsoft products that utilize the FBX library when processing specially crafted 3D content. An attacker who successfully exploited these vulnerabilities could gain the same user rights as the local user. (CVE-2020-7080, CVE-2020-7081, CVE-2020-7082, CVE-2020-7083, CVE-2020-7084, CVE-2020-7085)
    last seen2020-06-04
    modified2020-03-11
    plugin id134416
    published2020-03-11
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/134416
    titleSecurity Updates for Microsoft Office Products (March 2020)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    
    # The descriptive text and package checks in this plugin were  
    # extracted from the Microsoft Security Updates API. The text
    # itself is copyright (C) Microsoft Corporation.
    #
    
    
    include('compat.inc');
    
    if (description)
    {
      script_id(134416);
      script_version("1.7");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/03");
    
      script_cve_id(
        "CVE-2020-0850",
        "CVE-2020-0851",
        "CVE-2020-0852",
        "CVE-2020-0855",
        "CVE-2020-0892",
        "CVE-2020-7080",
        "CVE-2020-7081",
        "CVE-2020-7082",
        "CVE-2020-7083",
        "CVE-2020-7084",
        "CVE-2020-7085"
      );
      script_xref(name:"MSKB", value:"4484237");
      script_xref(name:"MSFT", value:"MS20-4484237");
    
      script_name(english:"Security Updates for Microsoft Office Products (March 2020)");
    
      script_set_attribute(attribute:"synopsis", value:
    "The Microsoft Office Products are affected by multiple vulnerabilities.");
      script_set_attribute(attribute:"description", value:
    "The Microsoft Office Products are missing security updates.
    It is, therefore, affected by multiple vulnerabilities :
    
      - A remote code execution vulnerability exists in
        Microsoft Word software when it fails to properly handle
        objects in memory. An attacker who successfully
        exploited the vulnerability could use a specially
        crafted file to perform actions in the security context
        of the current user. For example, the file could then
        take actions on behalf of the logged-on user with the
        same permissions as the current user.  (CVE-2020-0850,
        CVE-2020-0851, CVE-2020-0855, CVE-2020-0892)
    
      - A remote code execution vulnerability exists in
        Microsoft Word software when it fails to properly handle
        objects in memory. An attacker who successfully
        exploited the vulnerability could use a specially
        crafted file to perform actions in the security context
        of the current user. For example, the file could then
        take actions on behalf of the logged-on user with the
        same permissions as the current user.  (CVE-2020-0852)
    
      - Remote code execution vulnerabilities exist in Microsoft 
        products that utilize the FBX library when processing 
        specially crafted 3D content. An attacker who 
        successfully exploited these vulnerabilities could gain 
        the same user rights as the local user. (CVE-2020-7080, 
        CVE-2020-7081, CVE-2020-7082, CVE-2020-7083, 
        CVE-2020-7084, CVE-2020-7085)");
      # https://support.microsoft.com/en-us/help/4484237/security-update-for-office-2010-march-10-2020
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?e59db2e7");
      script_set_attribute(attribute:"solution", value:
    "Microsoft has released KB4484237 to address this issue for 
    Office 2010. And for Office 365, Office 2016 C2R, or Office 
    2019, ensure automatic updates are enabled or open any office 
    app and manually perform an update.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2020-0892");
    
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2020/03/10");
      script_set_attribute(attribute:"patch_publication_date", value:"2020/03/10");
      script_set_attribute(attribute:"plugin_publication_date", value:"2020/03/11");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:microsoft:office");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"Windows : Microsoft Bulletins");
    
      script_copyright(english:"This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
    
      script_dependencies("office_installed.nasl", "smb_hotfixes.nasl", "ms_bulletin_checks_possible.nasl");
      script_require_keys("SMB/MS_Bulletin_Checks/Possible");
      script_require_ports(139, 445, "Host/patch_management_checks");
    
      exit(0);
    }
    
    include('audit.inc');
    include('smb_func.inc');
    include('smb_hotfixes.inc');
    include('smb_hotfixes_fcheck.inc');
    include('smb_reg_query.inc');
    include('misc_func.inc');
    include('install_func.inc');
    
    get_kb_item_or_exit('SMB/MS_Bulletin_Checks/Possible');
    
    bulletin = 'MS20-03';
    kbs = make_list(
      '4484237'  # Office 2010 SP2 wwlibcxm.dll
    );
    
    if (get_kb_item('Host/patch_management_checks'))
      hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_HOLE);
    
    get_kb_item_or_exit('SMB/Registry/Enumerated', exit_code:1);
    
    vuln = FALSE;
    port = kb_smb_transport();
    
    office_vers = hotfix_check_office_version();
    
    # Office 2010 SP2
    if (office_vers['14.0'])
    {
      office_sp = get_kb_item('SMB/Office/2010/SP');
      if (!isnull(office_sp) && office_sp == 2)
      {
        prod = 'Microsoft Office 2010 SP2';
    
        # wwlibcxm.dll only exists if KB2428677 is installed
        path = hotfix_get_officeprogramfilesdir(officever:'14.0');
        path = hotfix_append_path(path:path, value:'Microsoft Office\\Office14');
        kb = '4484237';
        file = 'wwlibcxm.dll';
        version = '14.0.7246.5000';
        if (hotfix_check_fversion(file:file, version:version, path:path, kb:kb, bulletin:bulletin, product:prod) == HCF_OLDER)
          vuln = TRUE;
      }
    }
    
    # Office 2016 / 2019 / C2R
    if (office_vers['16.0'])
    {
      office_sp = get_kb_item('SMB/Office/2016/SP');
      if (!isnull(office_sp) && office_sp == 0)
      {
        prod = 'Microsoft Office 2016';
        prod2019 = 'Microsoft Office 2019';
        path = hotfix_get_officeprogramfilesdir(officever:'16.0');
        graph_exe_path = hotfix_append_path(path:path, value:'Microsoft Office\\root\\Office16');
        c2r_path = graph_exe_path;
        if (
          hotfix_check_fversion(file:'graph.exe', version:'16.0.11328.20554', channel:'Deferred', channel_product:'Office', path:c2r_path, bulletin:bulletin, product:prod) == HCF_OLDER ||
          hotfix_check_fversion(file:'graph.exe', version:'16.0.11929.20648', channel:'Deferred', channel_version:'1908', channel_product:'Office', path:c2r_path, bulletin:bulletin, product:prod) == HCF_OLDER ||
          hotfix_check_fversion(file:'graph.exe', version:'16.0.12527.20278', channel:'First Release for Deferred', channel_product:'Office', path:c2r_path, bulletin:bulletin, product:prod) == HCF_OLDER ||
          hotfix_check_fversion(file:'graph.exe', version:'16.0.12527.20278', channel:'Current', channel_product:'Office', path:c2r_path, bulletin:bulletin, product:prod) == HCF_OLDER ||
          # 2019
          hotfix_check_fversion(file:'graph.exe', version:'16.0.12527.20278', channel:'2019 Retail', channel_product:'Office', path:c2r_path, bulletin:bulletin, product:prod2019) == HCF_OLDER ||
          hotfix_check_fversion(file:'graph.exe', version:'16.0.10357.20081', channel:'2019 Volume', channel_product:'Office', path:c2r_path, bulletin:bulletin, product:prod2019) == HCF_OLDER
        )
        vuln = TRUE;
      }
    }
    if (vuln)
    {
      replace_kb_item(name:'SMB/Missing/'+bulletin, value:TRUE);
      hotfix_security_hole();
      hotfix_check_fversion_end();
      exit(0);
    }
    else
    {
      hotfix_check_fversion_end();
      audit(AUDIT_HOST_NOT, 'affected');
    }