PT-2021-22824 · Autodesk · Autodesk Fbx Review

Published 2021-09-15 · Updated 2022-06-16 · CVE-2021-40157

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Autodesk FBX Review versions 1.5.0 and prior

Description A user may be tricked into opening a malicious FBX file, which may exploit an Untrusted Pointer Dereference issue in FBX’s Review, causing it to run arbitrary code on the system.

Recommendations For versions 1.5.0 and prior, avoid opening malicious FBX files until a patch is available. As a temporary workaround, consider restricting the use of FBX file parsing functionality to minimize the risk of exploitation.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2021-40157

ZDI-21-1068

Affected Products

Autodesk Fbx Review

References · 6

• https://autodesk.com/trust/security-advisories/adsk-sa-2021-0001 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-40157 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-21-1068 · Security Note
• https://osv.dev/vulnerability/CVE-2021-40157 · Vendor Advisory
• https://t.me/cibsecurity/28904 · Telegram Post
• https://t.me/cvenotify/31759 · Telegram Post