A vulnerability, which was classified as critical, has been found in Autodesk Advance Steel, AutoCAD, AutoCAD Architecture, AutoCAD Electrical, AutoCAD Map 3D, AutoCAD Mechanical, AutoCAD MEP, AutoCAD P, ID, AutoCAD Plant 3D, AutoCAD LT and Civil 3D 2018. Affected by this issue is an unknown functionality of the component DXF Parser. The manipulation with an unknown input leads to a use after free vulnerability. Using CWE to declare the problem leads to CWE-416. Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code. Impacted is confidentiality, integrity, and availability. CVE summarizes:

An exploitable heap overflow vulnerability in the DXF-parsing functionality in Autodesk Advance Steel 2018, Autodesk AutoCAD 2018, Autodesk AutoCAD Architecture 2018, Autodesk AutoCAD Electrical 2018, Autodesk AutoCAD Map 3D 2018, Autodesk AutoCAD Mechanical 2018, Autodesk AutoCAD MEP 2018, Autodesk AutoCAD P&ID 2018, Autodesk AutoCAD Plant 3D 2018, Autodesk AutoCAD LT 2018, and Autodesk Civil 3D 2018. A specially crafted DXF file with too many cell margins populating an AcCellMargin object may cause a heap overflow, resulting in code execution.

The bug was discovered 02/14/2019. The weakness was shared 04/09/2019. This vulnerability is handled as CVE-2019-7360 since 02/04/2019. The attack may be launched remotely. No form of authentication is required for exploitation. Successful exploitation requires user interaction by the victim. The technical details are unknown and an exploit is not available.

The vulnerability was handled as a non-public zero-day exploit for at least 54 days. During that time the estimated underground price was around $0-$5k. The commercial vulnerability scanner Qualys is able to test this issue with plugin 371794 (Autodesk AutoCAD Multiple Vulnerabilities).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The entries 133272, 133273 and 133275 are related to this item.

Productinfo

Vendor

• Autodesk

Name

• Advance Steel
• AutoCAD
• AutoCAD Architecture
• AutoCAD Electrical
• AutoCAD LT
• AutoCAD Map 3D
• AutoCAD Mechanical
• AutoCAD MEP
• AutoCAD P
• AutoCAD Plant 3D
• Civil 3D
• ID

Version

• 2018

License

• commercial

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion