A stack-based buffer overflow vulnerability exists in the import_stl.cc:import_stl() functionality of Openscad openscad-2020.12-RC2. A specially crafted STL file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A stack-based buffer overflow vulnerability exists in the import_stl.cc:import_stl() functionality of     Openscad openscad-2020.12-RC2. A specially crafted STL file can lead to code execution. An attacker can     provide a malicious file to trigger this vulnerability. (CVE-2020-28599)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote host is affected by the vulnerability described in GLSA-202107-35 (OpenSCAD: Buffer overflow)

    A buffer overflow exists in OpenSCAD when parsing STL files.
  Impact :

    A remote attacker could entice a user to open a specially crafted STL       file using OpenSCAD, possibly resulting in execution of arbitrary code       with the privileges of the process or a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

The remote Fedora 32 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2021-793da7882b advisory.

  - A stack-based buffer overflow vulnerability exists in the import_stl.cc:import_stl() functionality of     Openscad openscad-2020.12-RC2. A specially crafted STL file can lead to code execution. An attacker can     provide a malicious file to trigger this vulnerability. (CVE-2020-28599)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 33 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2021-8349f28cb9 advisory.

  - A stack-based buffer overflow vulnerability exists in the import_stl.cc:import_stl() functionality of     Openscad openscad-2020.12-RC2. A specially crafted STL file can lead to code execution. An attacker can     provide a malicious file to trigger this vulnerability. (CVE-2020-28599)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
259469	Linux Distros Unpatched Vulnerability : CVE-2020-28599	Nessus	Misc.	Local	high
156976	GLSA-202107-35 : OpenSCAD: Buffer overflow	Nessus	Gentoo Local Security Checks	Local	high
147183	Fedora 32 : openscad (2021-793da7882b)	Nessus	Fedora Local Security Checks	Local	high
147180	Fedora 33 : openscad (2021-8349f28cb9)	Nessus	Fedora Local Security Checks	Local	high

Detections

Analytics

CVE-2020-28599

high

Tenable Plugins

high

high

high

high