A type confusion vulnerability in the Autodesk FBX-SDK versions 2019.0 and earlier may lead to arbitary code read/write on the system running it.

The Microsoft Office Products are missing security updates.
It is, therefore, affected by multiple vulnerabilities :

  - A remote code execution vulnerability exists in     Microsoft Word software when it fails to properly handle     objects in memory. An attacker who successfully     exploited the vulnerability could use a specially     crafted file to perform actions in the security context     of the current user. For example, the file could then     take actions on behalf of the logged-on user with the     same permissions as the current user.  (CVE-2020-0850,     CVE-2020-0851, CVE-2020-0855, CVE-2020-0892)

  - A remote code execution vulnerability exists in     Microsoft Word software when it fails to properly handle     objects in memory. An attacker who successfully     exploited the vulnerability could use a specially     crafted file to perform actions in the security context     of the current user. For example, the file could then     take actions on behalf of the logged-on user with the     same permissions as the current user.  (CVE-2020-0852)

  - Remote code execution vulnerabilities exist in Microsoft     products that utilize the FBX library when processing     specially crafted 3D content. An attacker who     successfully exploited these vulnerabilities could gain     the same user rights as the local user. (CVE-2020-7080,     CVE-2020-7081, CVE-2020-7082, CVE-2020-7083,     CVE-2020-7084, CVE-2020-7085)

The version of Autodesk FBX-SDK library installed on the remote host is prior to 2019.5. It is, therefore, affected by the following vulnerabilities :

  - A buffer overflow vulnerability in the Autodesk FBX-SDK may lead to arbitrary code execution on a system     running it. (CVE-2020-7080)

  - A type confusion vulnerability in the Autodesk FBX-SDK may lead to arbitary code read/write on the system     running it. (CVE-2020-7081)

  - A use-after-free vulnerability in the Autodesk FBX-SDK may lead to code execution on a system running it.
    (CVE-2020-7082)

  - An intager overflow vulnerability in the Autodesk FBX-SDK may lead to denial of service of the     application. (CVE-2020-7083)

  - A NULL pointer dereference vulnerability in the Autodesk FBX-SDK may lead to denial of service of the     application. (CVE-2020-7084)

  - A heap overflow vulnerability in the Autodesk FBX-SDK may lead to arbitrary code execution on a system     running it. (CVE-2020-7085)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
162025	Security Updates for Microsoft Office Products C2R (March 2020)	Nessus	Windows	high
135973	Autodesk FBX-SDK library <= 2019.5 Multiple Vulnerabilities (ADSK-SA-2020-0002)	Nessus	Windows	high
134416	Security Updates for Microsoft Office Products (March 2020)	Nessus	Windows : Microsoft Bulletins	high

Detections

Analytics

CVE-2020-7081

high

Tenable Plugins

high

high

high