ADV200004: Microsoft 發佈頻外公告，公開了 Autodesk Filmbox (FBX) Library 中的錯誤。
Microsoft responds to a recent security advisory from Autodesk by publishing an out-of-band advisory for Office products integrating the Autodesk library.
背景說明
On April 15, Autodesk released a security advisory, ADSK-SA-2020-0002, to address six vulnerabilities in the Autodesk Filmbox (FBX) Software Development Kit, which “allows application and content vendors to transfer existing content into the FBX format with minimal effort.”
In response to Autodesk’s advisory, Microsoft issued an out-of-band advisory, ADV200004, on April 21, as the FBX library is integrated into specific versions of Microsoft Office, Office 365 ProPlus and Paint 3D.
分析
In ADSK-SA-2020-0002, Autodesk patched the following six vulnerabilities:
| CVE | 弱點 | Impact | CVSSv3.x* |
|---|---|---|---|
| CVE-2020-7080 | Buffer Overflow | 任意程式碼執行 | 7.8 |
| CVE-2020-7081 | 類型混淆 | 任意程式碼執行，拒絕服務 | 無 |
| CVE-2020-7082 | 釋放後使用 | 任意程式碼執行 | 無 |
| CVE-2020-7083 | 整數溢位 | Denial of Service | 無 |
| CVE-2020-7084 | Null 指標取值 | Denial of Service | 5.5 |
| CVE-2020-7085 | 堆積緩衝區溢位 | 任意程式碼執行 | 7.8 |
*Please note that the CVSSv3.x scores referenced in the table above were available at the time this blog post was published and may be subject to change.
Though not all the vulnerabilities had CVSSv3.x scores assigned in their U.S. National Vulnerability Database entries, Autodesk collectively rated their advisory as High.
Exploitation of these vulnerabilities requires an attacker to convince their victim to open a malicious Microsoft Office, Office 365 ProPlus or Paint 3D file that contains specially crafted 3D content which takes advantage of the vulnerabilities in the FBX library.
概念驗證
F-Secure researcher Max Van Amerongen, credited with the discovery of CVE-2020-7085, has tweeted a proof-of-concept video demonstrating the heap overflow vulnerability:
My Autodesk FBX Heap Overflow (CVE-2020-7085) has now been disclosed at https://t.co/jvumWcCZE7
— maxpl0it (@maxpl0it) April 17, 2020
Works on FBX SDK < 2019.5
PoC video from disclosure: pic.twitter.com/vayCIomgaP
解決方法
Microsoft’s advisory states that it has addressed these vulnerabilities in the following products:
| 產品 | Version | 知識庫文章 |
|---|---|---|
| Microsoft Office 2016 | 隨選即用 32 位元和 64 位元版本 | Office 2016 C2R |
| Microsoft Office 2019 | 32 位元和 64 位元版本 | Office 2019 |
| Office 365 專業增強版 | 32 位元和 64 位元版本 | Office 365 專業增強版 |
| 小畫家 3D | 小畫家 3D 版本資訊 |
However, at the time this blog post was published, there were no new updates to the articles listed above. The last time these articles were updated was on April 14, which coincided with April’s Patch Tuesday release. It is unclear if Microsoft plans to release its updates as part of this out-of-band release, or if the fixes will be included as part of May’s Patch Tuesday release.
Since FBX is an included library in these versions of Office and Paint 3D and Microsoft released an out-of-band advisory for these flaws, we strongly encourage organizations to apply these patches as soon as they are available.
找出受影響的系統
A list of Tenable plugins to identify these vulnerabilities will appear here as they’re released.
取得更多資訊
加入 Tenable Community 的 Tenable 安全回應團隊。
深入瞭解 Tenable，這是用於全面管理新型攻擊破綻的首創 Cyber Exposure 平台。
索取 Tenable.io Vulnerability Management 的 30 天免費試用。
相關文章
CVE-2024-47575: Frequently Asked Questions About FortiJump Zero-Day in FortiManager and FortiManager Cloud
October 23, 2024Frequently asked questions about a zero-day vulnerability in Fortinet’s FortiManager that has reportedly been exploited in the wild.
From Bugs to Breaches: 25 Significant CVEs As MITRE CVE Turns 25
October 22, 2024Twenty five years after the launch of CVE, the Tenable Security Response Team has handpicked 25 vulnerabilities that stand out for their significance.
Oracle October 2024 Critical Patch Update Addresses 198 CVEs
October 15, 2024Oracle addresses 198 CVEs in its fourth quarterly update of 2024 with 334 patches, including 35 critical updates.
Cybersecurity Snapshot: Apply Zero Trust to Critical Infrastructure’s OT/ICS, CSA Advises, as Five Eyes Spotlight Tech Startups’ Security
November 1, 2024Should critical infrastructure orgs boost OT/ICS systems’ security with zero trust? Absolutely, the CSA says. Meanwhile, the Five Eyes countries offer cyber advice to tech startups. Plus, a survey finds “shadow AI” weakening data governance. And get the latest on MFA methods, CISO trends and Uncle Sam’s AI strategy.
FY 2024 State and Local Cybersecurity Grant Program Adds CISA KEV as a Performance Measure
October 31, 2024The CISA Known Exploited Vulnerabilities (KEV) catalog and enhanced logging guidelines are among the new measurement tools added for the 2024 State and Local Cybersecurity Grant Program.
Cybersecurity Snapshot: New Guides Offer Best Practices for Preventing Shadow AI and for Deploying Secure Software Updates
October 25, 2024Looking for help with shadow AI? Want to boost your software updates’ safety? New publications offer valuable tips. Plus, learn why GenAI and data security have become top drivers of cyber strategies. And get the latest on the top “no-nos” for software security; the EU’s new cyber law; and CISOs’ communications with boards.
- Vulnerability Management