A user may be tricked into opening a malicious FBX file that may exploit a stack buffer overflow vulnerability in Autodesk® FBX® SDK 2020 or prior which may lead to code execution.

The Microsoft Visual Studio Products are missing security updates. It is, therefore, affected by multiple vulnerabilities:

  - A remote code execution vulnerability in the MSDIA SDK where corrupted PDBs can cause heap overflow,     leading to a crash or remote code execution. (CVE-2023-24897)

  - A remote code execution vulnerability where specially crafted input to git apply -reject can lead to     controlled content writes at arbitrary locations. (CVE-2023-25652)

  - A spoofing vulnerability where Github localization messages refer to a hard-coded path instead of     respecting the runtime prefix that leads to out-of-bound memory writes and crashes. (CVE-2023-25815)

  - An Out-Of-Bounds Write Vulnerability in Autodesk FBX SDK version 2020 or prior may lead to code     execution through maliciously crafted FBX files or information disclosure. (CVE-2023-27909)

  - An information disclosure vulnerability where a user may be tricked into opening a malicious     FBX file. This may exploit a stack buffer overflow (CVE-2023-27910) or heap buffer overflow     (CVE-2023-27911) vulnerability in Autodesk FBX SDK 2020 or prior which may lead to remote code     execution. 

  - A remote code execution vulnerability where a configuration file containing a logic error results     in arbitrary configuration injection. (CVE-2023-29007)

  - A remote code execution vulnerability where the Git for Windows executable responsible for     implementing a SOCKS5 proxy is susceptible to picking up an untrusted configuration on multi-user     machines. (CVE-2023-29011)

  - A remote code execution vulnerability where the Git for Windows Git CMD program incorrectly     searches for a program upon startup, leading to silent arbitrary code execution. (CVE-2023-29012)

  - A remote code execution vulnerability in the .NET SDK during tool restore which can lead to an     elevation of privilege. (CVE-2023-33135)

  - An information disclosure vulnerability by the obj file parser in Visual Studio. (CVE-2023-33139)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Autodesk FBX-SDK library installed on the remote host is prior to 2020.3.4. It is, therefore, affected by multiple vulnerabilities:

  - An Out-Of-Bounds Write Vulnerability in Autodesk FBX SDK version 2020 or prior may lead to code execution through     maliciously crafted FBX files or information disclosure. ()

  - A user may be tricked into opening a malicious FBX file that may exploit a stack buffer overflow vulnerability in     Autodesk FBX SDK 2020 or prior which may lead to code execution. (CVE-2023-27910)   
  - A user may be tricked into opening a malicious FBX file that may exploit a heap buffer overflow vulnerability in     Autodesk FBX SDK 2020 or prior which may lead to code execution. (CVE-2023-27911)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
177249	Security Updates for Microsoft Visual Studio Products (June 2023)	Nessus	Windows : Microsoft Bulletins	high
174000	Autodesk FBX-SDK library < 2020.3.4 Multiple Vulnerabilities (ADSK-SA-2023-0004)	Nessus	Windows	high

Detections

Analytics

CVE-2023-27910

high

Tenable Plugins

high

high