CVE-2022-25793 (GCVE-0-2022-25793)

Vulnerability from cvelistv5 – Published: 2022-08-10 16:03 – Updated: 2024-08-03 04:49
VLAI?
Summary
A Stack-based Buffer Overflow Vulnerability in Autodesk 3ds Max 2022, 2021, and 2020 may lead to code execution through the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer when parsing ActionScript Byte Code files. This vulnerability may allow arbitrary code execution on affected installations of Autodesk 3ds Max.
Severity ?
No CVSS data available.
CWE
  • Stack-based Buffer Overflow
Assigner
References
Impacted products
Vendor Product Version
n/a Autodesk 3ds Max Affected: Autodesk 3ds Max 2022, 2021, 2020
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T04:49:44.009Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0006"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Autodesk 3ds Max",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "Autodesk 3ds Max\t2022, 2021, 2020"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A Stack-based Buffer Overflow Vulnerability in Autodesk 3ds Max 2022, 2021, and 2020 may lead to code execution through the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer when parsing ActionScript Byte Code files. This vulnerability may allow arbitrary code execution on affected installations of Autodesk 3ds Max."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Stack-based Buffer Overflow",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-08-10T16:03:59",
        "orgId": "7e40ea87-bc65-4944-9723-dd79dd760601",
        "shortName": "autodesk"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0006"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "psirt@autodesk.com",
          "ID": "CVE-2022-25793",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Autodesk 3ds Max",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "Autodesk 3ds Max\t2022, 2021, 2020"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A Stack-based Buffer Overflow Vulnerability in Autodesk 3ds Max 2022, 2021, and 2020 may lead to code execution through the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer when parsing ActionScript Byte Code files. This vulnerability may allow arbitrary code execution on affected installations of Autodesk 3ds Max."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Stack-based Buffer Overflow"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0006",
              "refsource": "MISC",
              "url": "https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0006"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7e40ea87-bc65-4944-9723-dd79dd760601",
    "assignerShortName": "autodesk",
    "cveId": "CVE-2022-25793",
    "datePublished": "2022-08-10T16:03:59",
    "dateReserved": "2022-02-22T00:00:00",
    "dateUpdated": "2024-08-03T04:49:44.009Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:autodesk:3ds_max:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"2020\", \"versionEndExcluding\": \"2020.3.6\", \"matchCriteriaId\": \"3CB4E3CB-2C64-44C8-ADA7-D88ED4A0C02B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:autodesk:3ds_max:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"2021\", \"versionEndExcluding\": \"2021.3.10\", \"matchCriteriaId\": \"23E83FC1-97C7-4AD6-806E-6ED14826E82D\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:autodesk:3ds_max:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"2022\", \"versionEndIncluding\": \"2022.3.3\", \"matchCriteriaId\": \"E71086D2-9206-46B5-A0F0-C1438C0774B5\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"A Stack-based Buffer Overflow Vulnerability in Autodesk 3ds Max 2022, 2021, and 2020 may lead to code execution through the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer when parsing ActionScript Byte Code files. This vulnerability may allow arbitrary code execution on affected installations of Autodesk 3ds Max.\"}, {\"lang\": \"es\", \"value\": \"Una vulnerabilidad de desbordamiento del b\\u00fafer en la regi\\u00f3n Stack de la memoria en Autodesk 3ds Max versiones 2022, 2021 y 2020, puede conllevar a una ejecuci\\u00f3n de c\\u00f3digo mediante la falta de comprobaci\\u00f3n apropiada de la longitud de los datos suministrados por el usuario antes de copiarlos en un b\\u00fafer en la regi\\u00f3n stack de la memoria de longitud fija cuando son analizados archivos de c\\u00f3digo de bytes de ActionScript. Esta vulnerabilidad puede permitir la ejecuci\\u00f3n de c\\u00f3digo arbitrario en las instalaciones afectadas de Autodesk 3ds Max\"}]",
      "id": "CVE-2022-25793",
      "lastModified": "2024-11-21T06:53:00.780",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"REQUIRED\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 5.9}]}",
      "published": "2022-08-10T20:15:31.807",
      "references": "[{\"url\": \"https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0006\", \"source\": \"psirt@autodesk.com\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0006\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Vendor Advisory\"]}]",
      "sourceIdentifier": "psirt@autodesk.com",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-1284\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-25793\",\"sourceIdentifier\":\"psirt@autodesk.com\",\"published\":\"2022-08-10T20:15:31.807\",\"lastModified\":\"2024-11-21T06:53:00.780\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A Stack-based Buffer Overflow Vulnerability in Autodesk 3ds Max 2022, 2021, and 2020 may lead to code execution through the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer when parsing ActionScript Byte Code files. This vulnerability may allow arbitrary code execution on affected installations of Autodesk 3ds Max.\"},{\"lang\":\"es\",\"value\":\"Una vulnerabilidad de desbordamiento del b\u00fafer en la regi\u00f3n Stack de la memoria en Autodesk 3ds Max versiones 2022, 2021 y 2020, puede conllevar a una ejecuci\u00f3n de c\u00f3digo mediante la falta de comprobaci\u00f3n apropiada de la longitud de los datos suministrados por el usuario antes de copiarlos en un b\u00fafer en la regi\u00f3n stack de la memoria de longitud fija cuando son analizados archivos de c\u00f3digo de bytes de ActionScript. Esta vulnerabilidad puede permitir la ejecuci\u00f3n de c\u00f3digo arbitrario en las instalaciones afectadas de Autodesk 3ds Max\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-1284\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:autodesk:3ds_max:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2020\",\"versionEndExcluding\":\"2020.3.6\",\"matchCriteriaId\":\"3CB4E3CB-2C64-44C8-ADA7-D88ED4A0C02B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:autodesk:3ds_max:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2021\",\"versionEndExcluding\":\"2021.3.10\",\"matchCriteriaId\":\"23E83FC1-97C7-4AD6-806E-6ED14826E82D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:autodesk:3ds_max:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2022\",\"versionEndIncluding\":\"2022.3.3\",\"matchCriteriaId\":\"E71086D2-9206-46B5-A0F0-C1438C0774B5\"}]}]}],\"references\":[{\"url\":\"https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0006\",\"source\":\"psirt@autodesk.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0006\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.