A vulnerability classified as critical has been found in Autodesk Advance Steel, AutoCAD, AutoCAD Architecture, AutoCAD Electrical, AutoCAD Map 3D, AutoCAD Mechanical, AutoCAD MEP, AutoCAD P, ID, AutoCAD Plant 3D, AutoCAD LT and Civil 3D 2018. Affected is some unknown processing of the component DXF Parser. The manipulation with an unknown input leads to a memory corruption vulnerability. CWE is classifying the issue as CWE-119. The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

An exploitable heap overflow vulnerability in the DXF-parsing functionality in Autodesk Advance Steel 2018, Autodesk AutoCAD 2018, Autodesk AutoCAD Architecture 2018, Autodesk AutoCAD Electrical 2018, Autodesk AutoCAD Map 3D 2018, Autodesk AutoCAD Mechanical 2018, Autodesk AutoCAD MEP 2018, Autodesk AutoCAD P&ID 2018, Autodesk AutoCAD Plant 3D 2018, Autodesk AutoCAD LT 2018, and Autodesk Civil 3D 2018. A specially crafted DXF file may cause a heap overflow, resulting in code execution.

The bug was discovered 02/14/2019. The weakness was disclosed 04/09/2019. This vulnerability is traded as CVE-2019-7358 since 02/04/2019. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Successful exploitation requires user interaction by the victim. There are neither technical details nor an exploit publicly available.

The vulnerability was handled as a non-public zero-day exploit for at least 54 days. During that time the estimated underground price was around $0-$5k. The commercial vulnerability scanner Qualys is able to test this issue with plugin 371794 (Autodesk AutoCAD Multiple Vulnerabilities).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The entries VDB-133273, VDB-133274 and VDB-133275 are pretty similar. VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Image Processing Software

Vendor

• Autodesk

Name

• Advance Steel
• AutoCAD
• AutoCAD Architecture
• AutoCAD Electrical
• AutoCAD LT
• AutoCAD Map 3D
• AutoCAD Mechanical
• AutoCAD MEP
• AutoCAD P
• AutoCAD Plant 3D
• Civil 3D
• ID

Version

• 2018

License

• commercial

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion