Multiple vulnerabilities in several Autodesk products

Published: 2022-04-06

Risk	High
Patch available	YES
Number of vulnerabilities	6
CVE-ID	CVE-2022-25789 CVE-2022-27528 CVE-2022-25796 CVE-2022-25792 CVE-2022-25790 CVE-2022-25791
CWE-ID	CWE-416 CWE-415 CWE-121 CWE-787 CWE-119
Exploitation vector	Network
Public exploit	N/A
Vulnerable software Subscribe	Autodesk AutoCAD Other software / Other software solutions Autodesk Navisworks Client/Desktop applications / Other client software Advance Steel Client/Desktop applications / Multimedia software AutoCAD Architecture Client/Desktop applications / Multimedia software Autodesk Civil 3D Client/Desktop applications / Multimedia software AutoCAD Electrical Client/Desktop applications / Multimedia software AutoCAD Map 3D Client/Desktop applications / Multimedia software AutoCAD Mechanical Client/Desktop applications / Multimedia software AutoCAD MEP Client/Desktop applications / Multimedia software AutoCAD Plant 3D Client/Desktop applications / Multimedia software AutoCAD LT Client/Desktop applications / Multimedia software AutoCAD Mac Client/Desktop applications / Multimedia software AutoCAD Mac LT Client/Desktop applications / Multimedia software
Vendor	Autodesk

Security Bulletin

This security bulletin contains information about 6 vulnerabilities.

1) Use-after-free

EUVDB-ID: #VU61922

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-25789

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the parsing of DWF, 3DS and DWFX files. A remote attacker can trick a victim to open a specially crafted file and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Autodesk AutoCAD: 2019 - 2022

Autodesk Navisworks: 2022

Advance Steel: 2019 - 2022

AutoCAD Architecture: 2019 - 2022

Autodesk Civil 3D: 2019 - 2022

AutoCAD Electrical: 2019 - 2022

AutoCAD Map 3D: 2019 - 2022

AutoCAD Mechanical: 2019 - 2022

AutoCAD MEP: 2019 - 2022

AutoCAD Plant 3D: 2019 - 2022

AutoCAD LT: 2019 - 2022.0

AutoCAD Mac: 2022.0

AutoCAD Mac LT: 2022.0

External links

http://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0005
http://www.zerodayinitiative.com/advisories/ZDI-22-571/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Use-after-free

EUVDB-ID: #VU61926

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-27528

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the parsing the DWFX and SKP files. A remote attacker can trick a victim to open a specially crafted file and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Autodesk AutoCAD: 2019 - 2022

Autodesk Navisworks: 2022

Advance Steel: 2019 - 2022

AutoCAD Architecture: 2019 - 2022

Autodesk Civil 3D: 2019 - 2022

AutoCAD Electrical: 2019 - 2022

AutoCAD Map 3D: 2019 - 2022

AutoCAD Mechanical: 2019 - 2022

AutoCAD MEP: 2019 - 2022

AutoCAD Plant 3D: 2019 - 2022

AutoCAD LT: 2019 - 2022.0

AutoCAD Mac: 2022.0

AutoCAD Mac LT: 2022.0

External links

http://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0005
http://www.zerodayinitiative.com/advisories/ZDI-22-557/
http://www.zerodayinitiative.com/advisories/ZDI-22-566/
http://www.zerodayinitiative.com/advisories/ZDI-22-568/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Double Free

EUVDB-ID: #VU61925

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-25796

CWE-ID: CWE-415 - Double Free

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the handling of DWF files. A remote attacker can trick a victim to open a specially crafted file, trigger double free error and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Autodesk AutoCAD: 2019 - 2022

Autodesk Navisworks: 2022

Advance Steel: 2019 - 2022

AutoCAD Architecture: 2019 - 2022

Autodesk Civil 3D: 2019 - 2022

AutoCAD Electrical: 2019 - 2022

AutoCAD Map 3D: 2019 - 2022

AutoCAD Mechanical: 2019 - 2022

AutoCAD MEP: 2019 - 2022

AutoCAD Plant 3D: 2019 - 2022

AutoCAD LT: 2019 - 2022.0

AutoCAD Mac: 2022.0

AutoCAD Mac LT: 2022.0

External links

http://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0005
http://www.zerodayinitiative.com/advisories/ZDI-22-574/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Stack-based buffer overflow

EUVDB-ID: #VU61924

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-25792

CWE-ID: CWE-121 - Stack-based buffer overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the parsing of DWF and DXF files. A remote unauthenticated attacker can trick a victim to open a specially crafted file, trigger stack-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Autodesk AutoCAD: 2019 - 2022

Autodesk Navisworks: 2022

Advance Steel: 2019 - 2022

AutoCAD Architecture: 2019 - 2022

Autodesk Civil 3D: 2019 - 2022

AutoCAD Electrical: 2019 - 2022

AutoCAD Map 3D: 2019 - 2022

AutoCAD Mechanical: 2019 - 2022

AutoCAD MEP: 2019 - 2022

AutoCAD Plant 3D: 2019 - 2022

AutoCAD LT: 2019 - 2022.0

AutoCAD Mac: 2022.0

AutoCAD Mac LT: 2022.0

External links

http://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0005
http://www.zerodayinitiative.com/advisories/ZDI-22-554/
http://www.zerodayinitiative.com/advisories/ZDI-22-567/
http://www.zerodayinitiative.com/advisories/ZDI-22-565/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Out-of-bounds write

EUVDB-ID: #VU61923

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-25790

CWE-ID: CWE-787 - Out-of-bounds write

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error within the parsing of DWF files. A remote attacker can create a specially crafted file, trick the victim into opening it using the affected software, trigger out-of-bounds write and execute arbitrary code on the target system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Autodesk AutoCAD: 2019 - 2022

Autodesk Navisworks: 2022

Advance Steel: 2019 - 2022

AutoCAD Architecture: 2019 - 2022

Autodesk Civil 3D: 2019 - 2022

AutoCAD Electrical: 2019 - 2022

AutoCAD Map 3D: 2019 - 2022

AutoCAD Mechanical: 2019 - 2022

AutoCAD MEP: 2019 - 2022

AutoCAD Plant 3D: 2019 - 2022

AutoCAD LT: 2019 - 2022.0

AutoCAD Mac: 2022.0

AutoCAD Mac LT: 2022.0

External links

http://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0005
http://www.zerodayinitiative.com/advisories/ZDI-22-570/
http://www.zerodayinitiative.com/advisories/ZDI-22-569/
http://www.zerodayinitiative.com/advisories/ZDI-22-563/
http://www.zerodayinitiative.com/advisories/ZDI-22-562/
http://www.zerodayinitiative.com/advisories/ZDI-22-560/
http://www.zerodayinitiative.com/advisories/ZDI-22-559/
http://www.zerodayinitiative.com/advisories/ZDI-22-553/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Buffer overflow

EUVDB-ID: #VU61921

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-25791

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the parsing of DWF or DWFX files. A remote attacker can create a specially crafted file, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Autodesk AutoCAD: 2019 - 2022

Autodesk Navisworks: 2022

Advance Steel: 2019 - 2022

AutoCAD Architecture: 2019 - 2022

Autodesk Civil 3D: 2019 - 2022

AutoCAD Electrical: 2019 - 2022

AutoCAD Map 3D: 2019 - 2022

AutoCAD Mechanical: 2019 - 2022

AutoCAD MEP: 2019 - 2022

AutoCAD Plant 3D: 2019 - 2022

AutoCAD LT: 2019 - 2022.0

AutoCAD Mac: 2022.0

AutoCAD Mac LT: 2022.0

External links

http://www.zerodayinitiative.com/advisories/ZDI-22-573/
http://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0005
http://www.zerodayinitiative.com/advisories/ZDI-22-564/
http://www.zerodayinitiative.com/advisories/ZDI-22-561/
http://www.zerodayinitiative.com/advisories/ZDI-22-558/
http://www.zerodayinitiative.com/advisories/ZDI-22-572/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.