Description
VariCAD EN up to and including version 2010-2.05 is vulnerable to a stack-based buffer overflow when parsing .dwb drawing files. The application fails to properly validate the length of input data embedded in the file, allowing a crafted .dwb file to overwrite critical memory structures. This flaw can be exploited locally by convincing a user to open a malicious file, resulting in arbitrary code execution.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
VariCAD VariCAD EN
Default version status: unaffected
0 to ≤ 2010-2.05affected
References
- https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/fileformat/varicad_dwb.rb ↗
- https://www.exploit-db.com/exploits/11789 ↗
- https://www.broadcom.com/support/security-center/attacksignatures/detail?asid=26522 ↗
- https://www.seebug.org/vuldb/ssvid-71154 ↗
- https://www.varicad.com/en/home/ ↗
- https://www.fortiguard.com/encyclopedia/ips/18735 ↗
- https://www.vulncheck.com/advisories/varicad-en-dwb-file-stack-buffer-overflow ↗