IT Risk Team Discovers Previously Unknown Vulnerability in Autodesk Software

guest · Aug 18, 2021

IT Risk Team Discovers Previously Unknown Vulnerability in Autodesk Software During Client Penetration Test
August 18, 2021
https://www.tripwire.com/state-of-s...vers-unknown-vulnerability-autodesk-software/

During a recent client engagement, the DGC (DiCicco, Gulman & Company) penetration testing team identified a previously unknown vulnerability affecting the Autodesk Licensing Service, a software component bundled with nearly all licensed Autodesk products.

The vulnerability exists in a software component common to most Autodesk products and impacts nearly all organizations using licensed Autodesk software in any capacity. The Common Vulnerabilities and Exposures number is CVE-2021-27032, Autodesk Licensing Service: Local Privilege Escalation.
Click to expand...

Because these software products are so widely deployed across the public and private sectors, vulnerabilities in Autodesk products pose a significant risk to many organizations, as Autodesk products are often used to generate and process intellectual property and other sensitive data.
Issue
The issue lies in the default permissions assigned to the Autodesk Licensing Service which runs as a locally privileged operating system account. The default privileges assigned to this service allow any authenticated user to modify the service configuration.
Click to expand...

Solution
DGC found and disclosed this vulnerability to the Autodesk Product Security Incident Response Team (PSIRT) immediately after discovering it during a penetration testing engagement. Because this vulnerability affected the entire Autodesk product suite, analysis and patching of the vulnerability took quite some time, but the PSIRT team was responsive and collaborative throughout the entire process.

Autodesk has fixed this vulnerability in version 10.2.0.4231 of the affected service, and has provided a security advisory for their customers detailing the vulnerability and affected software versions.
Click to expand...

Log in or Sign up

IT Risk Team Discovers Previously Unknown Vulnerability in Autodesk Software

guest Guest

Log in or Sign up

IT Risk Team Discovers Previously Unknown Vulnerability in Autodesk Software

guest Guest

Useful Searches