PT-2021-23792 · Open Design Alliance · Oda Viewer

Mat Powell · Published 2021-11-14 · Updated 2021-12-06 · CVE-2021-43272

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Open Design Alliance ODA Viewer versions prior to 2022.11

Description An improper handling of exceptional conditions issue exists in the ODA Viewer sample. When the viewer encounters invalid or malicious DWF files, it continues to process them instead of stopping upon an exception. This allows an attacker to execute code in the context of the current process by leveraging this issue.

Recommendations For versions prior to 2022.11, update to a version 2022.11 or later to resolve the issue. As a temporary workaround, consider restricting the processing of DWF files from untrusted sources until a patch is available.

Fix

Improper Handling of Exceptional Conditions

Weakness Enumeration

CWE-755

Related Identifiers

CVE-2021-43272

ZDI-21-1358

ZDI-21-1360

ZDI-21-1363

Affected Products

Oda Viewer

References · 8

• https://zerodayinitiative.com/advisories/ZDI-21-1358 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-43272 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-21-1360 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-21-1363 · Security Note
• https://osv.dev/vulnerability/CVE-2021-43272 · Vendor Advisory
• https://opendesign.com/security-advisories · Vendor Advisory
• https://t.me/cibsecurity/32380 · Telegram Post
• https://t.me/cvenotify/23402 · Telegram Post