ADV200004: Microsoft Releases Out-of-Band Advisory to Address Flaws in Autodesk Filmbox (FBX) Library

Microsoft responds to a recent security advisory from Autodesk by publishing an out-of-band advisory for Office products integrating the Autodesk library.

背景

On April 15, Autodesk released a security advisory, ADSK-SA-2020-0002, to address six vulnerabilities in the Autodesk Filmbox (FBX) Software Development Kit, which “allows application and content vendors to transfer existing content into the FBX format with minimal effort.”

In response to Autodesk’s advisory, Microsoft issued an out-of-band advisory, ADV200004, on April 21, as the FBX library is integrated into specific versions of Microsoft Office, Office 365 ProPlus and Paint 3D.

分析

In ADSK-SA-2020-0002, Autodesk patched the following six vulnerabilities:

*Please note that the CVSSv3.x scores referenced in the table above were available at the time this blog post was published and may be subject to change.

Though not all the vulnerabilities had CVSSv3.x scores assigned in their U.S. National Vulnerability Database entries, Autodesk collectively rated their advisory as High.

Exploitation of these vulnerabilities requires an attacker to convince their victim to open a malicious Microsoft Office, Office 365 ProPlus or Paint 3D file that contains specially crafted 3D content which takes advantage of the vulnerabilities in the FBX library.

概念验证

F-Secure researcher Max Van Amerongen, credited with the discovery of CVE-2020-7085, has tweeted a proof-of-concept video demonstrating the heap overflow vulnerability:

My Autodesk FBX Heap Overflow (CVE-2020-7085) has now been disclosed at https://t.co/jvumWcCZE7

Works on FBX SDK < 2019.5

PoC video from disclosure: pic.twitter.com/vayCIomgaP

— maxpl0it (@maxpl0it) April 17, 2020

解决方案

Microsoft’s advisory states that it has addressed these vulnerabilities in the following products:

However, at the time this blog post was published, there were no new updates to the articles listed above. The last time these articles were updated was on April 14, which coincided with April’s Patch Tuesday release. It is unclear if Microsoft plans to release its updates as part of this out-of-band release, or if the fixes will be included as part of May’s Patch Tuesday release.

Since FBX is an included library in these versions of Office and Paint 3D and Microsoft released an out-of-band advisory for these flaws, we strongly encourage organizations to apply these patches as soon as they are available.

识别受影响的系统

用于识别这些漏洞的 Tenable 插件列表在发布时将显示在此处。

获取更多信息

• Autodesk Advisory ADSK-SA-2020-0002
• Microsoft Out-of-Band Advisory (ADV200004)

加入 Tenable Community 中的 Tenable 安全响应团队

了解有关 Tenable 这款首创 Cyber Exposure 平台的更多信息，全面管理现代攻击面。

获取 30 天免费试用版 Tenable.io Vulnerability Management。