Executive brief
Autodesk FBX-SDK is a software development kit used by developers to integrate 3D content into applications. A vulnerability in this kit allows attackers to execute malicious code on a user's system if the user is tricked into opening or converting a specially crafted DXF file. This could lead to a full system compromise, data theft, or unauthorized software installation.
Technical details
The Autodesk FBX-SDK versions prior to 2017.1 are vulnerable to multiple buffer overflows (CWE-119) during the processing of DXF format files. The root cause is improper restriction of operations within the bounds of a memory buffer when reading or converting malformed files. An attacker can exploit this by providing a specially crafted DXF file to an application using the vulnerable SDK. Successful exploitation requires user interaction (opening the file) and can result in arbitrary code execution with the privileges of the application. Autodesk has released version 2017.1 to address these issues.
Affected products
- Autodesk FBX Software Development Kit Before 2017.1
Timeline
- 2017-01-25: disclosed
- 2017-01-25: advisory