PT-2021-2160 · Luxion · Luxion Keyshot Viewer+3

Rgod · Published 2021-02-04 · Updated 2021-03-23 · CVE-2021-22643

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Luxion KeyShot versions prior to 10.1 Luxion KeyShot Viewer versions prior to 10.1 Luxion KeyShot Network Rendering versions prior to 10.1 Luxion KeyVR versions prior to 10.1

Description The issue is related to an out-of-bounds read while processing project files, which may allow an attacker to execute arbitrary code. This occurs due to a buffer read beyond its boundaries in memory, potentially enabling an attacker to run arbitrary code during project processing.

Recommendations For Luxion KeyShot versions prior to 10.1, update to version 10.1 or later. For Luxion KeyShot Viewer versions prior to 10.1, update to version 10.1 or later. For Luxion KeyShot Network Rendering versions prior to 10.1, update to version 10.1 or later. For Luxion KeyVR versions prior to 10.1, update to version 10.1 or later.

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

BDU:2021-01052

CVE-2021-22643

ZDI-21-316

ZDI-21-319

Affected Products

Luxion Keyshot

Luxion Keyshot Network Rendering

Luxion Keyshot Viewer

Luxion Keyvr

References · 10

• https://zerodayinitiative.com/advisories/ZDI-21-319 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-22643 · Security Note
• https://osv.dev/vulnerability/CVE-2021-22643 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-21-316 · Security Note
• https://bdu.fstec.ru/vul/2021-01052 · Security Note
• https://cert-portal.siemens.com/productcert/pdf/ssa-231216.pdf · Note
• https://t.me/cvenotify/10328 · Telegram Post
• https://us-cert.gov/ics/advisories/icsa-21-035-01 · Note
• https://us-cert.cisa.gov/ics/advisories/icsa-21-035-01 · Note
• https://t.me/cibsecurity/23977 · Telegram Post