ADV200004: Microsoft Releases Out-of-Band Advisory to Address Flaws in Autodesk Filmbox (FBX) Library
Microsoft responds to a recent security advisory from Autodesk by publishing an out-of-band advisory for Office products integrating the Autodesk library.
Background
On April 15, Autodesk released a security advisory, ADSK-SA-2020-0002, to address six vulnerabilities in the Autodesk Filmbox (FBX) Software Development Kit, which “allows application and content vendors to transfer existing content into the FBX format with minimal effort.”
In response to Autodesk’s advisory, Microsoft issued an out-of-band advisory, ADV200004, on April 21, as the FBX library is integrated into specific versions of Microsoft Office, Office 365 ProPlus and Paint 3D.
التحليل
In ADSK-SA-2020-0002, Autodesk patched the following six vulnerabilities:
| CVE | Vulnerability | Impact | CVSSv3.x* |
|---|---|---|---|
| CVE-2020-7080 | Buffer Overflow | Arbitrary Code Execution | 7.8 |
| CVE-2020-7081 | Type Confusion | Arbitrary Code Execution, Denial of Service | N/A |
| CVE-2020-7082 | Use-After-Free | Arbitrary Code Execution | N/A |
| CVE-2020-7083 | Integer Overflow | Denial of Service | N/A |
| CVE-2020-7084 | Null Pointer Dereference | Denial of Service | 5.5 |
| CVE-2020-7085 | Heap Overflow | Arbitrary Code Execution | 7.8 |
*Please note that the CVSSv3.x scores referenced in the table above were available at the time this blog post was published and may be subject to change.
Though not all the vulnerabilities had CVSSv3.x scores assigned in their U.S. National Vulnerability Database entries, Autodesk collectively rated their advisory as High.
Exploitation of these vulnerabilities requires an attacker to convince their victim to open a malicious Microsoft Office, Office 365 ProPlus or Paint 3D file that contains specially crafted 3D content which takes advantage of the vulnerabilities in the FBX library.
Proof of concept
F-Secure researcher Max Van Amerongen, credited with the discovery of CVE-2020-7085, has tweeted a proof-of-concept video demonstrating the heap overflow vulnerability:
My Autodesk FBX Heap Overflow (CVE-2020-7085) has now been disclosed at https://t.co/jvumWcCZE7
— maxpl0it (@maxpl0it) April 17, 2020
Works on FBX SDK < 2019.5
PoC video from disclosure: pic.twitter.com/vayCIomgaP
Solution
Microsoft’s advisory states that it has addressed these vulnerabilities in the following products:
| Product | Version | Knowledge Base Article |
|---|---|---|
| Microsoft Office 2016 | Click-to-Run 32-bit and 64-bit editions | Office 2016 C2R |
| Microsoft Office 2019 | 32-bit and 64-bit editions | Office 2019 |
| Office 365 ProPlus | 32-bit and 64-bit editions | Office 365 ProPlus |
| Paint 3D | Paint 3D Release Notes |
However, at the time this blog post was published, there were no new updates to the articles listed above. The last time these articles were updated was on April 14, which coincided with April’s Patch Tuesday release. It is unclear if Microsoft plans to release its updates as part of this out-of-band release, or if the fixes will be included as part of May’s Patch Tuesday release.
Since FBX is an included library in these versions of Office and Paint 3D and Microsoft released an out-of-band advisory for these flaws, we strongly encourage organizations to apply these patches as soon as they are available.
Identifying affected systems
A list of Tenable plugins to identify these vulnerabilities will appear here as they’re released.
الحصول على مزيد من المعلومات
Join Tenable's Security Response Team on the Tenable Community.
Learn more about Tenable, the first Cyber Exposure platform for holistic management of your modern attack surface.
Get a free 30-day trial of Tenable.io Vulnerability Management.
مقالات ذات صلة
CVE-2024-7593: Ivanti Virtual Traffic Manager Authentication Bypass Vulnerability
August 14, 2024Ivanti released a patch for a critical severity authentication bypass vulnerability and a warning that exploit code is publicly available
CVE-2024-20419: Cisco Smart Software Manager On-Prem Password Change Vulnerability
August 9, 2024Critical vulnerability in Cisco Smart Software Manager On-Prem exposes systems to unauthorized password changes, exploit code now available.BackgroundOn July 17, 2024, Cisco published an advisory for ...
Detecting Risky Third-party Drivers on Windows Assets
August 7, 2024Kernel-mode drivers are critical yet risky components of the Windows operating system. Learn about their functionality, the dangers they pose, and how Tenable's new plugins can help identify and mitigate vulnerabilities using community-driven resources like LOLDrivers.
Cybersecurity Snapshot: Guide Unpacks Event-Logging Best Practices, as FAA Proposes Stronger Cyber Rules for Airplanes
August 23, 2024Looking to sharpen your team’s event logging and threat detection? A new guide offers plenty of best practices. Plus, the FAA wants airplanes to be more resilient to cyberattacks. Meanwhile, check out the critical vulnerabilities Tenable discovered in two Microsoft AI products. And get the latest on ransomware trends, vulnerability management practices and election security!
SSRFing the Web with the Help of Copilot Studio
August 20, 2024Tenable Research discovered a critical information-disclosure vulnerability in Microsoft’s Copilot Studio via a server-side request forgery (SSRF), which allowed researchers access to potentially sensitive information regarding service internals with potential cross-tenant impact.
Cybersecurity Snapshot: First Quantum-resistant Algorithms Ready for Use, While New AI Risks’ Database Is Unveiled
August 16, 2024NIST has released the first encryption algorithms that can protect data against quantum attacks. Plus, MIT launched a new database of AI risks. Meanwhile, the CSA published a paper outlining the unique risks involved in building systems that use LLMs. And get the latest on Q2’s most prevalent malware, the Radar/Dispossessor ransomware gang and CVE severity assessments!
- Vulnerability Management