TL;DR

Autodesk AutoCAD is vulnerable to a remote code execution attack via out-of-bounds write, leading to potential exploitation by opening a malicious MODEL file or visiting a compromised site.

What happened

['Remote attackers can execute arbitrary code on affected AutoCAD installations', 'User interaction is required for the vulnerability to be exploited']

Why it matters for ops

["Inadequate validation of input data in AutoCAD's MODEL files handling", 'Potential use by threat actors to gain unauthorized access and control over systems']

Mitigation

  • Update to the latest version of Autodesk AutoCAD that includes the fix for this vulnerability
  • Restrict access to and monitoring of MODEL files in production environments

Action items

  • Apply available security updates immediately
  • Review network traffic logs for signs of suspicious activity related to this threat

Detection IOCs

  • Unexpected network traffic from AutoCAD clients to unfamiliar servers
  • Unusual file creation or modification patterns involving MODEL files

Source link

http://www.zerodayinitiative.com/advisories/ZDI-26-107/