Is CVE-2016-9305 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2016-9305 being exploited in the wild.

How severe is CVE-2016-9305?

Critical severity, with a CVSS score of 9.8, published 25 January 2017.

Which products and versions are affected?

Autodesk FBX Software Development Kit (SDK) Before 2017.1.

Is there a fix for CVE-2016-9305?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2016-9305 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2016-9305?

Check whether you run Autodesk FBX Software Development Kit (SDK) or Autodesk Fbx Software Development Kit at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2016-9305: Autodesk FBX-SDK uninitialized pointer access in FBX parsing

CVE-2016-9305 · Severity: critical · CVSS 9.8 · Published 2017-01-25

The Autodesk FBX SDK, a tool used by developers to integrate 3D data exchange into their applications, contains a critical vulnerability in how it processes FBX files. An attacker could provide a specially crafted, malicious file that, when opened or converted by an application using this library, could allow them to gain unauthorized access to system memory. This could lead to the theft of sensitive information, system crashes, or the execution of malicious code, potentially compromising the entire application and the data it handles.

Technologies: Autodesk FBX Software Development Kit (SDK). Vendors: Autodesk.

Quick answers

Is CVE-2016-9305 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2016-9305 being exploited in the wild.
How severe is CVE-2016-9305?: Critical severity, with a CVSS score of 9.8, published 25 January 2017.
Which products and versions are affected?: Autodesk FBX Software Development Kit (SDK) Before 2017.1.
Is there a fix for CVE-2016-9305?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2016-9305 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2016-9305?: Check whether you run Autodesk FBX Software Development Kit (SDK) or Autodesk Fbx Software Development Kit at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability exists in the Autodesk FBX-SDK versions prior to 2017.1 due to improper data processing during the reading and conversion of FBX format files. Specifically, the SDK fails to correctly handle type mismatches and references to previously deleted objects within malformed files. This flaw allows an attacker to trigger access to uninitialized pointers. Given the CVSS score and vector, this is categorized as a remote attack that requires no authentication or user interaction, potentially leading to full compromise of confidentiality, integrity, and availability (RCE or information disclosure). The issue is resolved in FBX-SDK version 2017.1.

Affected products

Autodesk FBX Software Development Kit (SDK) Before 2017.1

Timeline

2017-01-25: disclosed
2017-01-25: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.