PT-2021-23793 · Open Design Alliance · Open Design Alliance Drawings Sdk

Mat Powell · Published 2021-11-10 · Updated 2023-02-09 · CVE-2021-43273

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Open Design Alliance Drawings SDK versions prior to 2022.11

Description An Out-of-bounds Read vulnerability exists in the DGN file reading procedure. Crafted data in a DGN file and lack of verification of input data can trigger a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.

Recommendations For versions prior to 2022.11, update to a version 2022.11 or later to resolve the issue. As a temporary workaround, consider restricting the use of DGN files from untrusted sources to minimize the risk of exploitation. Avoid using the Drawings SDK to parse crafted DGN files until the issue is resolved.

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

CVE-2021-43273

ZDI-21-1281

ZDI-21-1291

ZDI-21-1351

ZDI-21-1357

ZDI-23-122

Affected Products

Open Design Alliance Drawings Sdk

References · 11

• https://zerodayinitiative.com/advisories/ZDI-23-122 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-21-1351 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-21-1357 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-21-1281 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-21-1291 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-43273 · Security Note
• https://osv.dev/vulnerability/CVE-2021-43273 · Vendor Advisory
• https://opendesign.com/security-advisories · Vendor Advisory
• https://t.me/cvenotify/23401 · Telegram Post
• https://t.me/cibsecurity/32389 · Telegram Post
• https://t.me/cvenotify/23929 · Telegram Post