PT-2020-13574 · Pixar · Pixar Openusd

Aleksandar Nikolic · Published 2020-12-02 · Updated 2022-10-05 · CVE-2020-13497

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Pixar OpenUSD version 20.05

Description An issue exists in the way Pixar OpenUSD handles certain encoded types, allowing an arbitrary out of bounds memory access in String Type Index. This can be triggered by a specially crafted malformed file, potentially aiding further exploitation by bypassing mitigations. The victim must access an attacker-provided malformed file to trigger this issue.

Recommendations For Pixar OpenUSD version 20.05, consider avoiding the use of files from untrusted sources until a fix is available. As a temporary workaround, restrict access to potentially malicious files to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Out of bounds Read

Buffer Overflow

Weakness Enumeration

CWE-125

CWE-119

Related Identifiers

CVE-2020-13497

Affected Products

Pixar Openusd

References · 4

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2020-1105 · Exploit
• https://osv.dev/vulnerability/CVE-2020-13497 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-13497 · Security Note
• https://t.me/cibsecurity/17045 · Telegram Post