PT-2020-13575 · Pixar · Pixar Openusd

Aleksandar Nikolic · Published 2020-12-02 · Updated 2022-12-02 · CVE-2020-13498

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Pixar OpenUSD version 20.05

Description An issue exists in the way Pixar OpenUSD handles certain encoded types, allowing a specially crafted malformed file to trigger an arbitrary out of bounds memory access. This could lead to information disclosure and potentially aid further exploitation by bypassing mitigations. The victim must access an attacker-provided malformed file to trigger the issue.

Recommendations For Pixar OpenUSD version 20.05, consider avoiding the use of files from untrusted sources until a patch is available. As a temporary workaround, restrict access to potentially malicious files to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

CVE-2020-13498

Affected Products

Pixar Openusd

References · 4

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2020-1105 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-13498 · Security Note
• https://osv.dev/vulnerability/CVE-2020-13498 · Vendor Advisory
• https://t.me/cibsecurity/17048 · Telegram Post