Sign-up

ID

VAR-202104-1475


CVE

CVE-2021-31784


TITLE

Open Design Alliance Drawings SDK  Out-of-bounds Vulnerability in Microsoft

Trust: 0.8

sources: JVNDB: JVNDB-2021-006067

DESCRIPTION

An out-of-bounds write vulnerability exists in the file-reading procedure in Open Design Alliance Drawings SDK before 2021.6 on all supported by ODA platforms in static configuration. This can allow attackers to cause a crash, potentially enabling a denial of service attack (Crash, Exit, or Restart) or possible code execution. The development kit accesses the data in .dwg and .dgn through a convenient, object-oriented API, and provides functions such as C++ API, support for repairing files, and support for .NET, JAVA, and Python development languages

Trust: 1.8

sources: NVD: CVE-2021-31784 // JVNDB: JVNDB-2021-006067 // VULHUB: VHN-391575 // VULMON: CVE-2021-31784

AFFECTED PRODUCTS

vendor:opendesignmodel:drawings sdkscope:ltversion:2021.6

Trust: 1.0

vendor:siemensmodel:comosscope:ltversion:10.4.1

Trust: 1.0

vendor:open design alliancemodel:drawings sdkscope:eqversion:2021.6

Trust: 0.8

vendor:open design alliancemodel:drawings sdkscope:eqversion: -

Trust: 0.8

sources: JVNDB: JVNDB-2021-006067 // NVD: CVE-2021-31784

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2021-31784
value: HIGH

Trust: 1.0

NVD: CVE-2021-31784
value: CRITICAL

Trust: 0.8

CNNVD: CNNVD-202104-1874
value: HIGH

Trust: 0.6

VULHUB: VHN-391575
value: MEDIUM

Trust: 0.1

VULMON: CVE-2021-31784
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2021-31784
severity: MEDIUM
baseScore: 6.8
vectorString: AV:N/AC:M/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 8.6
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.0

NVD: CVE-2021-31784
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: NONE
impactScore: NONE
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.9

VULHUB: VHN-391575
severity: MEDIUM
baseScore: 6.8
vectorString: AV:N/AC:M/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 8.6
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2021-31784
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 1.8
impactScore: 5.9
version: 3.1

Trust: 1.0

NVD: CVE-2021-31784
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: VULHUB: VHN-391575 // VULMON: CVE-2021-31784 // JVNDB: JVNDB-2021-006067 // CNNVD: CNNVD-202104-1874 // NVD: CVE-2021-31784

PROBLEMTYPE DATA

problemtype:CWE-787

Trust: 1.1

problemtype:Out-of-bounds writing (CWE-787) [NVD Evaluation ]

Trust: 0.8

sources: VULHUB: VHN-391575 // JVNDB: JVNDB-2021-006067 // NVD: CVE-2021-31784

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-202104-1874

TYPE

buffer error

Trust: 0.6

sources: CNNVD: CNNVD-202104-1874

PATCH

title:Vulnerabilities in the ODA Drawings Software Development Kiturl:https://www.opendesign.com/security-advisories

Trust: 0.8

title:Open Design Alliance Drawings SDK Buffer error vulnerability fixurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=149348

Trust: 0.6

sources: JVNDB: JVNDB-2021-006067 // CNNVD: CNNVD-202104-1874

EXTERNAL IDS

db:NVDid:CVE-2021-31784

Trust: 3.4

db:SIEMENSid:SSA-155599

Trust: 1.7

db:ICS CERTid:ICSA-21-047-01

Trust: 1.4

db:JVNid:JVNVU92291213

Trust: 0.8

db:JVNDBid:JVNDB-2021-006067

Trust: 0.8

db:ICS CERTid:ICSA-22-069-06

Trust: 0.6

db:ICS CERTid:ICSA-21-040-06

Trust: 0.6

db:CS-HELPid:SB2022031102

Trust: 0.6

db:AUSCERTid:ESB-2022.1047

Trust: 0.6

db:CNNVDid:CNNVD-202104-1874

Trust: 0.6

db:VULHUBid:VHN-391575

Trust: 0.1

db:VULMONid:CVE-2021-31784

Trust: 0.1

sources: VULHUB: VHN-391575 // VULMON: CVE-2021-31784 // JVNDB: JVNDB-2021-006067 // CNNVD: CNNVD-202104-1874 // NVD: CVE-2021-31784

REFERENCES

url:https://www.opendesign.com/security-advisories

Trust: 1.8

url:https://cert-portal.siemens.com/productcert/pdf/ssa-155599.pdf

Trust: 1.7

url:https://nvd.nist.gov/vuln/detail/cve-2021-31784

Trust: 1.4

url:http://jvn.jp/vu/jvnvu92291213/index.html

Trust: 0.8

url:https://www.cisa.gov/uscert/ics/advisories/icsa-21-047-01

Trust: 0.8

url:https://www.auscert.org.au/bulletins/esb-2022.1047

Trust: 0.6

url:https://us-cert.cisa.gov/ics/advisories/icsa-21-040-06

Trust: 0.6

url:https://us-cert.cisa.gov/ics/advisories/icsa-21-047-01

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2022031102

Trust: 0.6

url:https://us-cert.cisa.gov/ics/advisories/icsa-22-069-06

Trust: 0.6

url:https://cwe.mitre.org/data/definitions/787.html

Trust: 0.1

url:https://nvd.nist.gov

Trust: 0.1

sources: VULHUB: VHN-391575 // VULMON: CVE-2021-31784 // JVNDB: JVNDB-2021-006067 // CNNVD: CNNVD-202104-1874 // NVD: CVE-2021-31784

CREDITS

Siemens reported these vulnerabilities to CISA.

Trust: 0.6

sources: CNNVD: CNNVD-202104-1874

SOURCES

db:VULHUBid:VHN-391575
db:VULMONid:CVE-2021-31784
db:JVNDBid:JVNDB-2021-006067
db:CNNVDid:CNNVD-202104-1874
db:NVDid:CVE-2021-31784

LAST UPDATE DATE

2024-08-14T12:32:10.755000+00:00


SOURCES UPDATE DATE

db:VULHUBid:VHN-391575date:2022-04-15T00:00:00
db:VULMONid:CVE-2021-31784date:2021-05-04T00:00:00
db:JVNDBid:JVNDB-2021-006067date:2021-12-24T07:47:00
db:CNNVDid:CNNVD-202104-1874date:2022-04-18T00:00:00
db:NVDid:CVE-2021-31784date:2022-04-15T15:40:04.410

SOURCES RELEASE DATE

db:VULHUBid:VHN-391575date:2021-04-26T00:00:00
db:VULMONid:CVE-2021-31784date:2021-04-26T00:00:00
db:JVNDBid:JVNDB-2021-006067date:2021-12-24T00:00:00
db:CNNVDid:CNNVD-202104-1874date:2021-04-26T00:00:00
db:NVDid:CVE-2021-31784date:2021-04-26T19:15:08.613