From c4901695d9577ebc7b34dccae11fc21d869d01de Mon Sep 17 00:00:00 2001 From: Brendan McDevitt Date: Fri, 20 May 2022 17:28:56 -0500 Subject: [PATCH] added example captured data potential from advisory for autodesk --- .../cnas_with_html_advisories.md | 27 +++++++++++++++++++ 1 file changed, 27 insertions(+) diff --git a/doc/cna_readme_notes/cnas_with_html_advisories.md b/doc/cna_readme_notes/cnas_with_html_advisories.md index 983f825..fb4fa83 100644 --- a/doc/cna_readme_notes/cnas_with_html_advisories.md +++ b/doc/cna_readme_notes/cnas_with_html_advisories.md @@ -179,6 +179,33 @@ The page listed in the CNAList.json for this org is the advisory policy document ### Advisory https://www.autodesk.com/trust/security-advisories #### Captured Data Potential From Advisory +``` +{ + :bulletin_id => 'ADSK-SA-2022-0010', + :product_service_component => 'Autodesk® 3ds Max®', + :impact => 'Out-of-bound Read/Write', + :severity => 'High', + :original_publish => '5/4/2022', + :last_revised => '5/4/2022', + :summary => 'Applications and services that utilize Autodesk 3ds Max may be affected by Out-of-bound Read/Write vulnerabilities. Exploitation of these vulnerabilities may lead to remote code execution.', + :description => 'The details of the vulnerabilities are as follows: 1) CVE-2022-27531 - A maliciously crafted TIF file can be forced to read beyond allocated boundaries in Autodesk 3ds Max 2022, and 2021 when parsing the TIF files. This vulnerability in conjunction with other vulnerabilities could lead to code execution in the context of the current process. 2) CVE-2022-27532 - A maliciously crafted TIF file in Autodesk 3ds Max 2022 and 2021 can be used to write beyond the allocated buffer while parsing TIF files. This vulnerability in conjunction with other vulnerabilities could lead to arbitrary code execution.', + :affected_products =>[ + { + :item => 'Autodesk® 3ds Max®', + :impacted_versions => '2022,2021', + :mitigated_versions => '2022.3.3, 2021.3.8', + :updated_source => 'Autodesk Desktop App, or Accounts Portal' + } + ], + :revision_history => [ + { + :revision => '1.0', + :date => '5/4/2022', + :description => 'Description: Initial Release of Security advisory' + } + ] +} +``` ## Avaya, Inc ### Advisory