PT-2021-7836 · Open Design Alliance · Open Design Alliance Drawings Sdk

Izobashi + 1 · Published 2021-01-18 · Updated 2022-04-08 · CVE-2021-25175

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Open Design Alliance Drawings SDK versions prior to 2021.11

Description A Type Conversion issue and a NULL pointer dereference exist when rendering malformed .DXF and .DWG files. This can allow attackers to cause a crash, potentially enabling a denial of service attack. The issue can be exploited by rendering malformed files, leading to a crash or potentially allowing remote code execution.

Recommendations For versions prior to 2021.11, update to a version 2021.11 or later to resolve the issue. As a temporary workaround, consider restricting the rendering of .DXF and .DWG files from untrusted sources to minimize the risk of exploitation. Avoid using the Drawings SDK to render malformed files until the issue is resolved.

Fix

Incorrect Type Conversion or Cast

Weakness Enumeration

CWE-704

Related Identifiers

BDU:2023-03534

CVE-2021-25175

ZDI-21-218

ZDI-21-223

ZDI-21-224

ZDI-21-244

ZDI-21-245

ZDI-21-246

Affected Products

Open Design Alliance Drawings Sdk

References · 16

• https://cert-portal.siemens.com/productcert/pdf/ssa-663999.pdf · Patch
• https://cert-portal.siemens.com/productcert/pdf/ssa-155599.pdf · Patch
• https://zerodayinitiative.com/advisories/ZDI-21-223 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-21-244 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-21-218 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-21-224 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-21-246 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-21-245 · Security Note
• https://opendesign.com/security-advisories · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-25175 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-03534 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-25175 · Security Note
• https://vuldb.com/?id.168067 · Note
• https://t.me/cibsecurity/22244 · Telegram Post
• https://t.me/cvenotify/8899 · Telegram Post