PT-2023-3129 · Autodesk · Autodesk Fbx-Sdk

Published 2023-03-29 · Updated 2023-09-26 · CVE-2023-27909

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Autodesk FBX SDK versions 2020 or prior

Description The issue is related to an Out-Of-Bounds Write, which may lead to code execution or information disclosure through maliciously crafted FBX files.

Recommendations For versions 2020 or prior, update to a version later than 2020 to resolve the issue. As a temporary workaround, consider restricting the use of maliciously crafted FBX files until a patch is available. Avoid using the FBX SDK to parse untrusted FBX files until the issue is resolved.

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

BDU:2023-03227

CVE-2023-27909

ZDI-23-1421

Affected Products

Autodesk Fbx-Sdk

References · 16

• https://bdu.fstec.ru/vul/2023-03227 · Security Note
• https://osv.dev/vulnerability/CVE-2023-27909 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-23-1421 · Security Note
• https://autodesk.com/trust/security-advisories/adsk-sa-2023-0004 · Vendor Advisory
• https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-27909 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-27909 · Security Note
• https://t.me/cibsecurity/62313 · Telegram Post
• https://twitter.com/htmdcommunity/status/1704382381010907486 · Twitter Post
• https://twitter.com/htmdcommunity/status/1706262273151705177 · Twitter Post
• https://t.me/cvenotify/48460 · Telegram Post
• https://twitter.com/htmdcommunity/status/1705175106874495392 · Twitter Post
• https://t.me/cvenotify/49143 · Telegram Post
• https://twitter.com/htmdcommunity/status/1704188933238837715 · Twitter Post
• https://twitter.com/htmdcommunity/status/1706624661008867340 · Twitter Post
• https://cybersecurity-help.cz/vdb/SB2023061404 · Note