PT-2020-13573 · Pixar · Pixar Openusd

Aleksandar Nikolic · Published 2020-12-02 · Updated 2022-06-29 · CVE-2020-13496

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Pixar OpenUSD version 20.05

Description An issue exists in the way Pixar OpenUSD handles certain encoded types, allowing an attacker to trigger an arbitrary out of bounds memory access in TfToken Type Index with a specially crafted malformed file. This could be used to bypass mitigations and aid further exploitation. The victim needs to access an attacker-provided malformed file to trigger this issue.

Recommendations For Pixar OpenUSD version 20.05, consider avoiding the use of files from untrusted sources until a patch is available. As a temporary workaround, restrict access to potentially malicious files to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

Out of bounds Read

Buffer Overflow

Weakness Enumeration

CWE-125

CWE-119

Related Identifiers

CVE-2020-13496

Affected Products

Pixar Openusd

References · 4

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2020-1105 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-13496 · Security Note
• https://osv.dev/vulnerability/CVE-2020-13496 · Vendor Advisory
• https://t.me/cibsecurity/17042 · Telegram Post