PT-2021-3513 · Autodesk · Autodesk Design Review

Published 2021-01-29 · Updated 2022-09-12 · CVE-2021-27038

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Autodesk Design Review versions 2011 through 2018

Description A Type Confusion issue occurs when processing a maliciously crafted PDF file, allowing a malicious actor to execute arbitrary code. The vulnerability is related to errors in data type conversion during PDF file parsing.

Recommendations For Autodesk Design Review versions 2011 through 2018, update to a version that includes a fix for this issue. As a temporary workaround, consider avoiding the processing of PDF files from untrusted sources until a patch is available. Restrict access to the PDF parsing functionality to minimize the risk of exploitation.

Fix

Type Confusion

Weakness Enumeration

CWE-843

Related Identifiers

BDU:2021-03562

CVE-2021-27038

ZDI-21-1317

ZDI-21-718

Affected Products

Autodesk Design Review

References · 12

• https://osv.dev/vulnerability/CVE-2021-27038 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-21-1317 · Security Note
• https://bdu.fstec.ru/vul/2021-03562 · Security Note
• https://safe-surf.ru/upload/VULN/VULN-20210701.4.pdf · Security Note
• https://zerodayinitiative.com/advisories/ZDI-21-718 · Security Note
• https://autodesk.com/trust/security-advisories/adsk-sa-2022-0004 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-27038 · Security Note
• https://cybersecurity-help.cz/vdb/SB2021062401 · Note
• https://securitylab.ru/vulnerability/521602.php · Note
• https://autodesk.com/trust/security-advisories/adsk-sa-2021-0003 · Note
• https://t.me/cvenotify/36005 · Telegram Post
• https://t.me/cvenotify/17477 · Telegram Post