PT-2022-3904 · Open Design Alliance · Open Design Alliance Drawings Sdk

Yonghui Han · Published 2022-04-08 · Updated 2022-07-25 · CVE-2022-28808

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Open Design Alliance Drawings SDK versions prior to 2023.3

Description An issue exists in the recovery mode of the Drawings SDK when reading DWG files, allowing for an Out-of-Bounds Read. This can be leveraged by an attacker to execute code in the context of the current process. The vulnerability is related to a buffer overflow in memory when processing DWG files, which can lead to arbitrary code execution or denial of service.

Recommendations For versions prior to 2023.3, update to version 2023.3 or later to resolve the issue. As a temporary workaround, consider restricting the use of the recovery mode when reading DWG files to minimize the risk of exploitation. Avoid using the Drawings SDK to process untrusted DWG files until the issue is resolved.

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

BDU:2022-04716

CVE-2022-28808

Affected Products

Open Design Alliance Drawings Sdk

References · 8

• https://opendesign.com/security-advisories · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-28808 · Security Note
• https://bdu.fstec.ru/vul/2022-04716 · Security Note
• https://osv.dev/vulnerability/CVE-2022-28808 · Vendor Advisory
• https://vuldb.com/ru/?id.204065 · Note
• https://cert-portal.siemens.com/productcert/html/ssa-137900.html · Note
• https://t.me/cibsecurity/46415 · Telegram Post
• https://cert-portal.siemens.com/productcert/pdf/ssa-429204.pdf · Note