PT-2022-4319 · Pdftron+1 · Pdftron+4

Published 2022-05-25 · Updated 2022-06-29 · CVE-2022-27871

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Autodesk AutoCAD product suite versions prior to 9.1.17 Revit versions prior to 9.1.17 Design Review versions prior to 9.1.17 Navisworks releases versions prior to 9.1.17

Description The issue is related to the PDFTron component in Autodesk software, which can be exploited to execute arbitrary code when parsing PDF files. This is due to a buffer overflow vulnerability, allowing writing beyond the allocated buffer. The vulnerability can be exploited by a remote attacker.

Recommendations For Autodesk AutoCAD product suite versions prior to 9.1.17, update to version 9.1.17 or later. For Revit versions prior to 9.1.17, update to version 9.1.17 or later. For Design Review versions prior to 9.1.17, update to version 9.1.17 or later. For Navisworks releases versions prior to 9.1.17, update to version 9.1.17 or later. As a temporary workaround, consider restricting the use of the PDFTron component until a patch is available. Avoid using the PDFTron component to parse PDF files until the issue is resolved.

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

BDU:2022-05175

CVE-2022-27871

Affected Products

Autodesk Autocad

Design Review

Navisworks

Pdftron

Revit

References · 6

• https://osv.dev/vulnerability/CVE-2022-27871 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-27871 · Security Note
• https://bdu.fstec.ru/vul/2022-05175 · Security Note
• https://autodesk.com/trust/security-advisories/adsk-sa-2022-0011 · Vendor Advisory
• https://t.me/cvenotify/32367 · Telegram Post
• http://autodesk.com/trust/security-advisories/adsk-sa-2022-0011 · Note