[Japanese]

JVNDB-2024-000073

Assimp vulnerable to heap-based buffer overflow

Overview

Assimp provided by Open Asset Import Library contains a heap-based buffer overflow vulnerability (CWE-122).

Yuhei Kawakoya of NTT Security Holdings reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
CVSS Severity (What is CVSS?)

CVSS V3 Severity:
Base Metrics 8.4 (High) [IPA Score]
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High
Affected Products


Open Asset Import Library
  • Assimp versions prior to 5.4.2

Impact

An attacker may execute arbitrary code by inputting a specially crafted file into the product.
Solution

[Update the Software]
Update the software to the latest version according to the information provided by the developer.

The developer has released version 5.4.2 that contains a fix for this vulnerability.
Vendor Information

Open Asset Import Library
CWE (What is CWE?)

  1. Buffer Errors(CWE-119) [IPA Evaluation]
CVE (What is CVE?)

  1. CVE-2024-40724
References

  1. JVN : JVN#87710540
Revision History

  • [2024/07/18]
      Web page was published

Date Public2024/07/18
Date First Published2024/07/18
Date Last Updated2024/07/18