PT-2024-25037 · Dassault Systèmes · Edrawings

Mat Powell · Published 2024-03-08 · Updated 2024-09-02 · CVE-2024-3299

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions eDrawings versions Release SOLIDWORKS 2023 through Release SOLIDWORKS 2024

Description The issue exists in the file reading procedure, allowing an attacker to execute arbitrary code while opening a specially crafted SLDDRW or SLDPRT file. This is due to Out-Of-Bounds Write, Use of Uninitialized Resource, and Use-After-Free vulnerabilities.

Recommendations For versions Release SOLIDWORKS 2023 through Release SOLIDWORKS 2024, consider avoiding the use of SLDDRW and SLDPRT files from untrusted sources until a patch is available. As a temporary workaround, restrict access to the file reading procedure to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Use of Uninitialized Resource

Memory Corruption

Use After Free

Weakness Enumeration

CWE-908

CWE-787

CWE-416

Related Identifiers

CVE-2024-3299

ZDI-24-253

ZDI-24-261

ZDI-24-267

Affected Products

Edrawings

References · 7

• https://zerodayinitiative.com/advisories/ZDI-24-253 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-24-261 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-3299 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-24-267 · Security Note
• https://t.me/cvenotify/75733 · Telegram Post
• https://3ds.com/vulnerability/advisories · Note
• https://t.me/cvenotify/92989 · Telegram Post