PT-2021-18085 · Esri · Arcgis Pro+3

Francis Provencher · Published 2021-03-25 · Updated 2024-07-11 · CVE-2021-29097

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Esri ArcReader versions 10.8.1 and earlier ArcGIS Desktop versions 10.8.1 and earlier ArcGIS Engine versions 10.8.1 and earlier ArcGIS Pro versions 2.7 and earlier

Description: Multiple buffer overflow vulnerabilities exist when parsing a specially crafted file, allowing an unauthenticated attacker to achieve arbitrary code execution in the context of the current user.

Recommendations: For Esri ArcReader versions 10.8.1 and earlier, update to a version later than 10.8.1. For ArcGIS Desktop versions 10.8.1 and earlier, update to a version later than 10.8.1. For ArcGIS Engine versions 10.8.1 and earlier, update to a version later than 10.8.1. For ArcGIS Pro versions 2.7 and earlier, update to a version later than 2.7.

Fix

Heap Based Buffer Overflow

Buffer Overflow

Stack Overflow

Weakness Enumeration

CWE-122

CWE-119

CWE-121

Related Identifiers

CVE-2021-29097

ZDI-21-360

ZDI-21-363

ZDI-21-364

ZDI-21-365

ZDI-21-366

ZDI-21-367

ZDI-21-368

ZDI-21-369

ZDI-21-371

Affected Products

Arcgis Desktop

Arcgis Engine

Arcgis Pro

Esri Arcreader

References · 15

• https://zerodayinitiative.com/advisories/ZDI-21-371 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-21-368 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-21-363 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-21-367 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-21-360 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-21-364 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-21-365 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-29097 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-21-369 · Security Note
• https://osv.dev/vulnerability/CVE-2021-29097 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-21-366 · Security Note
• https://esri.com/arcgis-blog/products/arcgis/administration/security-advisory-general-raster · Vendor Advisory
• https://t.me/cvenotify/12115 · Telegram Post
• https://t.me/cvenotify/80560 · Telegram Post
• https://t.me/cvenotify/85928 · Telegram Post