Quick answers
- Is CVE-2016-9304 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2016-9304 being exploited in the wild.
- How severe is CVE-2016-9304?
- High severity, with a CVSS score of 8.8, published 25 January 2017.
- Which products and versions are affected?
- Autodesk FBX Software Development Kit Before 2017.1.
- Is there a fix for CVE-2016-9304?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2016-9304 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2016-9304?
- Check whether you run Autodesk Fbx Software Development Kit. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The Autodesk FBX-SDK versions prior to 2017.1 are vulnerable to multiple buffer overflows (CWE-119) during the processing of DXF format files. The root cause is improper restriction of operations within the bounds of a memory buffer when reading or converting malformed files. An attacker can exploit this by providing a specially crafted DXF file to an application using the vulnerable SDK. Successful exploitation requires user interaction (opening the file) and can result in arbitrary code execution with the privileges of the application. Autodesk has released version 2017.1 to address these issues.
Affected products
- Autodesk FBX Software Development Kit Before 2017.1
Timeline
- 2017-01-25: disclosed
- 2017-01-25: advisory