PT-2021-17473 · Luxion · Keyshot

Rgod · Published 2021-05-12 · Updated 2021-06-10 · CVE-2021-27488

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions KeyShot versions v10.1 and prior

Description The issue concerns a lack of proper validation of user-supplied data when parsing CATPart files in certain software libraries. This could result in an out-of-bounds write past the end of an allocated structure, potentially allowing an attacker to execute code in the context of the current process.

Recommendations For KeyShot versions v10.1 and prior, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2021-27488

ZDI-21-563

Affected Products

Keyshot

References · 5

• https://zerodayinitiative.com/advisories/ZDI-21-563 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-27488 · Security Note
• https://osv.dev/vulnerability/CVE-2021-27488 · Vendor Advisory
• https://us-cert.cisa.gov/ics/advisories/icsa-21-145-01 · Note
• https://cert-portal.siemens.com/productcert/pdf/ssa-119468.pdf · Note