Vulnerability-Lookup

CNVD-2021-89162

Vulnerability from cnvd - Published: 2021-11-19

Title

Open Design Alliance Drawings SDK存在未明漏洞（CNVD-2021-89162）

Description

Open Design Alliance Drawings SDK是美国Open Design Alliance公司的一款应用于图纸设计的软件开发包。该开发包通过方便的，面向对象的API访问.dwg和.dgn中的数据，提供C++API、支持修复文件、.NET，JAVA，Python开发语言的支持等功能。 Open Design Alliance Drawings SDK 存在安全漏洞，该漏洞源于针对样本存在异常情况漏洞处理不当。ODA Viewer继续处理无效或恶意的DWF文件，而不是在异常时停止。攻击者可以利用此漏洞在当前进程的上下文中执行代码。

Severity

高

Patch Name

Open Design Alliance Drawings SDK存在未明漏洞（CNVD-2021-89162）的补丁

Patch Description

Formal description

目前厂商已发布升级补丁以修复漏洞，补丁获取链接： https://www.opendesign.com/security-advisories

Reference

https://www.opendesign.com/security-advisories

Impacted products

Name
Open Design Alliance Drawings SDK <2022.11

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2021-43272"
    }
  },
  "description": "Open Design Alliance Drawings SDK\u662f\u7f8e\u56fdOpen Design Alliance\u516c\u53f8\u7684\u4e00\u6b3e\u5e94\u7528\u4e8e\u56fe\u7eb8\u8bbe\u8ba1\u7684\u8f6f\u4ef6\u5f00\u53d1\u5305\u3002\u8be5\u5f00\u53d1\u5305\u901a\u8fc7\u65b9\u4fbf\u7684\uff0c\u9762\u5411\u5bf9\u8c61\u7684API\u8bbf\u95ee.dwg\u548c.dgn\u4e2d\u7684\u6570\u636e\uff0c\u63d0\u4f9bC++API\u3001\u652f\u6301\u4fee\u590d\u6587\u4ef6\u3001.NET\uff0cJAVA\uff0cPython\u5f00\u53d1\u8bed\u8a00\u7684\u652f\u6301\u7b49\u529f\u80fd\u3002\n\nOpen Design Alliance Drawings SDK \u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u9488\u5bf9\u6837\u672c\u5b58\u5728\u5f02\u5e38\u60c5\u51b5\u6f0f\u6d1e\u5904\u7406\u4e0d\u5f53\u3002ODA Viewer\u7ee7\u7eed\u5904\u7406\u65e0\u6548\u6216\u6076\u610f\u7684DWF\u6587\u4ef6\uff0c\u800c\u4e0d\u662f\u5728\u5f02\u5e38\u65f6\u505c\u6b62\u3002\u653b\u51fb\u8005\u53ef\u4ee5\u5229\u7528\u6b64\u6f0f\u6d1e\u5728\u5f53\u524d\u8fdb\u7a0b\u7684\u4e0a\u4e0b\u6587\u4e2d\u6267\u884c\u4ee3\u7801\u3002",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u53d1\u5e03\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6f0f\u6d1e\uff0c\u8865\u4e01\u83b7\u53d6\u94fe\u63a5\uff1a\r\nhttps://www.opendesign.com/security-advisories",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2021-89162",
  "openTime": "2021-11-19",
  "patchDescription": "Open Design Alliance Drawings SDK\u662f\u7f8e\u56fdOpen Design Alliance\u516c\u53f8\u7684\u4e00\u6b3e\u5e94\u7528\u4e8e\u56fe\u7eb8\u8bbe\u8ba1\u7684\u8f6f\u4ef6\u5f00\u53d1\u5305\u3002\u8be5\u5f00\u53d1\u5305\u901a\u8fc7\u65b9\u4fbf\u7684\uff0c\u9762\u5411\u5bf9\u8c61\u7684API\u8bbf\u95ee.dwg\u548c.dgn\u4e2d\u7684\u6570\u636e\uff0c\u63d0\u4f9bC++API\u3001\u652f\u6301\u4fee\u590d\u6587\u4ef6\u3001.NET\uff0cJAVA\uff0cPython\u5f00\u53d1\u8bed\u8a00\u7684\u652f\u6301\u7b49\u529f\u80fd\u3002\r\n\r\nOpen Design Alliance Drawings SDK \u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u9488\u5bf9\u6837\u672c\u5b58\u5728\u5f02\u5e38\u60c5\u51b5\u6f0f\u6d1e\u5904\u7406\u4e0d\u5f53\u3002ODA Viewer\u7ee7\u7eed\u5904\u7406\u65e0\u6548\u6216\u6076\u610f\u7684DWF\u6587\u4ef6\uff0c\u800c\u4e0d\u662f\u5728\u5f02\u5e38\u65f6\u505c\u6b62\u3002\u653b\u51fb\u8005\u53ef\u4ee5\u5229\u7528\u6b64\u6f0f\u6d1e\u5728\u5f53\u524d\u8fdb\u7a0b\u7684\u4e0a\u4e0b\u6587\u4e2d\u6267\u884c\u4ee3\u7801\u3002 \u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Open Design Alliance Drawings SDK\u5b58\u5728\u672a\u660e\u6f0f\u6d1e\uff08CNVD-2021-89162\uff09\u7684\u8865\u4e01",
  "products": {
    "product": "Open Design Alliance Drawings SDK \u003c2022.11"
  },
  "referenceLink": "https://www.opendesign.com/security-advisories",
  "serverity": "\u9ad8",
  "submitTime": "2021-11-16",
  "title": "Open Design Alliance Drawings SDK\u5b58\u5728\u672a\u660e\u6f0f\u6d1e\uff08CNVD-2021-89162\uff09"
}

CVE-2021-43272 (GCVE-0-2021-43272)

Vulnerability from cvelistv5 – Published: 2021-11-14 20:59 – Updated: 2024-08-04 03:55

Summary

An improper handling of exceptional conditions vulnerability exists in Open Design Alliance ODA Viewer sample before 2022.11. ODA Viewer continues to process invalid or malicious DWF files instead of stopping upon an exception. An attacker can leverage this vulnerability to execute code in the context of the current process.

Severity

No CVSS data available.

CWE

Assigner

mitre mitre root

References

4 references

URL	Tags
https://www.opendesign.com/security-advisories	x_refsource_MISC
https://www.zerodayinitiative.com/advisories/ZDI-…	x_refsource_MISC
https://www.zerodayinitiative.com/advisories/ZDI-…	x_refsource_MISC
https://www.zerodayinitiative.com/advisories/ZDI-…	x_refsource_MISC

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T03:55:28.419Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.opendesign.com/security-advisories"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.zerodayinitiative.com/advisories/ZDI-21-1363/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.zerodayinitiative.com/advisories/ZDI-21-1360/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.zerodayinitiative.com/advisories/ZDI-21-1358/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An improper handling of exceptional conditions vulnerability exists in Open Design Alliance ODA Viewer sample before 2022.11. ODA Viewer continues to process invalid or malicious DWF files instead of stopping upon an exception. An attacker can leverage this vulnerability to execute code in the context of the current process."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-11-30T11:06:17.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.opendesign.com/security-advisories"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.zerodayinitiative.com/advisories/ZDI-21-1363/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.zerodayinitiative.com/advisories/ZDI-21-1360/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.zerodayinitiative.com/advisories/ZDI-21-1358/"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2021-43272",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "An improper handling of exceptional conditions vulnerability exists in Open Design Alliance ODA Viewer sample before 2022.11. ODA Viewer continues to process invalid or malicious DWF files instead of stopping upon an exception. An attacker can leverage this vulnerability to execute code in the context of the current process."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.opendesign.com/security-advisories",
              "refsource": "MISC",
              "url": "https://www.opendesign.com/security-advisories"
            },
            {
              "name": "https://www.zerodayinitiative.com/advisories/ZDI-21-1363/",
              "refsource": "MISC",
              "url": "https://www.zerodayinitiative.com/advisories/ZDI-21-1363/"
            },
            {
              "name": "https://www.zerodayinitiative.com/advisories/ZDI-21-1360/",
              "refsource": "MISC",
              "url": "https://www.zerodayinitiative.com/advisories/ZDI-21-1360/"
            },
            {
              "name": "https://www.zerodayinitiative.com/advisories/ZDI-21-1358/",
              "refsource": "MISC",
              "url": "https://www.zerodayinitiative.com/advisories/ZDI-21-1358/"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2021-43272",
    "datePublished": "2021-11-14T20:59:16.000Z",
    "dateReserved": "2021-11-02T00:00:00.000Z",
    "dateUpdated": "2024-08-04T03:55:28.419Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.