Executive brief
The Autodesk FBX SDK, a tool used by developers to integrate 3D data exchange into their applications, is vulnerable to memory corruption issues. An attacker can exploit this by providing a specially crafted FBX file, which could lead to unauthorized code execution or cause the application to crash or freeze. This could result in a total loss of system confidentiality and availability if a user processes a malicious file.
Technical details
The Autodesk FBX SDK versions prior to 2017.1 contain multiple buffer overflow vulnerabilities (CWE-119) within the file parsing logic. These flaws are triggered when the SDK attempts to read or convert malformed FBX format files. A remote, unauthenticated attacker can exploit these vulnerabilities by tricking a user or automated system into processing a malicious FBX file. Successful exploitation can lead to arbitrary code execution in the context of the application using the SDK or a denial-of-service via an infinite loop. The issue is resolved in FBX SDK version 2017.1.
Affected products
- Autodesk FBX Software Development Kit Before 2017.1
Timeline
- 2017-01-25: advisory: NVD publication date
- 2017-01-25: disclosed: Initial disclosure of the vulnerability