PT-2021-17479 · Luxion · Keyshot

Rgod · Published 2021-05-12 · Updated 2021-06-09 · CVE-2021-27496

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions KeyShot versions prior to v10.1 Datakit Software libraries CatiaV5 3dRead, CatiaV6 3dRead, Step3dRead, Ug3dReadPsr, Jt3dReadPsr modules in KeyShot versions v10.1 and prior

Description The issue arises from the lack of proper validation of user-supplied data when parsing PRT files, potentially leading to pointer dereferences of a value obtained from an untrusted source. This could allow an attacker to execute code in the context of the current process.

Recommendations For KeyShot versions prior to v10.1, update to a version newer than v10.1 to resolve the issue. As a temporary workaround, consider restricting the use of the CatiaV5 3dRead, CatiaV6 3dRead, Step3dRead, Ug3dReadPsr, Jt3dReadPsr modules until a patch is available. Avoid using untrusted PRT files in the affected KeyShot versions until the issue is resolved.

Fix

Untrusted Pointer Dereference

Weakness Enumeration

CWE-822

Related Identifiers

CVE-2021-27496

ZDI-21-565

Affected Products

Keyshot

References · 5

• https://zerodayinitiative.com/advisories/ZDI-21-565 · Security Note
• https://osv.dev/vulnerability/CVE-2021-27496 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-27496 · Security Note
• https://us-cert.cisa.gov/ics/advisories/icsa-21-145-01 · Note
• https://cert-portal.siemens.com/productcert/pdf/ssa-119468.pdf · Note