Headline

CVE-2022-40649: ZDI-22-1205

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ansys SpaceClaim 2022 R1. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of X_B files. The issue results from the lack of proper initialization of a pointer prior to accessing it. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-17565.

2 years ago

CVE

Open in Source

#vulnerability #zero_day

07/19/22 – ZDI reported the vulnerability to the vendor.

07/26/22 – ZDI reached out asking for an update.

07/26/22 – Ansys Support asked if the vulnerability report was support related.

07/26/22 – ZDI explained that the report is regarding vulnerabilities in SpaceClaim.

07/26/22 – Ansys Support asked what the reports were for and if we were reporting vulnerabilities in SpaceClaim.

07/26/22 – ZDI confirmed that the report is for SpaceClaim.

07/26/22 – Ansys Support forwarded the vulnerability report to sales, and they asked us if we had worked with an Ansys sales or channel partner representative.

07/26/22 – ZDI informed Ansys that we are a research organization reporting vulnerabilities in Ansys SpaceClaim.

07/26/22 – Ansys sales informed us that they do not have a need for our services.

07/27/22 – ZDI contacted the Ansys VP of Cybersecurity about the report.

07/27/22 – Ansys VP of Cybersecurity acknowledged the report and that they would get back to us.

08/03/22 – ZDI reached out asking for an update.

08/24/22 – ZDI notified the vendor of the intention to publish the case as a zero-day advisory on 09/13/22.

– Mitigation: Given the nature of the vulnerability, the only salient mitigation strategy is to restrict interaction with the application.

SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with Orion admin-level account access to SolarWinds Web Console to execute arbitrary commands.