PT-2020-3992 · Autodesk · Autodesk Dynamo Bim

Published 2020-04-17 · Updated 2020-04-23 · CVE-2020-7079

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Autodesk Dynamo BIM versions 2.5.0 through 2.5.1

Description: The issue is related to improper signature validation and path checking errors for loaded dynamic libraries in the Dynamo BIM graphical programming add-on. This could allow an attacker to execute arbitrary code through maliciously crafted DLL files.

Recommendations: For Autodesk Dynamo BIM versions 2.5.0 and 2.5.1, consider restricting the loading of external DLL files until a patch is available. As a temporary workaround, avoid using potentially malicious DLL files with the affected software until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Untrusted Search Path

Weakness Enumeration

CWE-426

Related Identifiers

BDU:2020-04386

CVE-2020-7079

Affected Products

Autodesk Dynamo Bim

References · 4

• https://bdu.fstec.ru/vul/2020-04386 · Security Note
• https://autodesk.com/trust/security-advisories/adsk-sa-2020-0001 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-7079 · Security Note
• https://osv.dev/vulnerability/CVE-2020-7079 · Vendor Advisory