Executive Summary

This vulnerability is a heap-based out-of-bounds read in the OBJ file parser component of Open CASCADE Technology (OCCT) version V8_0_0_rc5. It occurs because the function Standard_ReadLineBuffer::ReadLine() can return a very small buffer (1 byte) for minimal OBJ lines, but the function RWObj_Reader::read() calls pushIndices() with a pointer offset that assumes a larger buffer without validating its length. This can lead to reading memory outside the intended buffer.

Useful 0 Not Useful 0

Impact Analysis

An attacker who convinces a victim to open a specially crafted OBJ file can exploit this vulnerability to cause a denial of service (crash) or potentially obtain sensitive information from the memory of the affected application.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows user-assisted attackers to cause a denial of service or obtain sensitive information by persuading a victim to open a crafted OBJ file. This exposure of sensitive information could potentially impact compliance with data protection regulations such as GDPR or HIPAA, which require safeguarding sensitive data against unauthorized access.

However, the provided information does not specify the exact nature or type of sensitive information that could be exposed, nor does it detail the regulatory impact explicitly.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by analyzing the behavior of the OBJ file parser when processing crafted OBJ files that cause out-of-bounds reads. Using memory error detection tools such as AddressSanitizer (ASAN) can consistently detect the out-of-bounds read triggered by minimal or malformed OBJ lines.

Specifically, monitoring for crashes or denial of service symptoms when opening OBJ files with Open CASCADE Technology (OCCT) versions vulnerable to this issue can indicate exploitation attempts.

While no direct commands are provided, running OCCT with ASAN enabled on suspicious OBJ files can help detect the vulnerability. For example, you can run the OCCT application or test harness under ASAN and open suspect OBJ files to observe memory errors.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include avoiding opening untrusted or crafted OBJ files with vulnerable versions of Open CASCADE Technology (OCCT).

Applying patches or updates that validate the length of the buffer returned by ReadLine before further processing is essential to prevent exploitation.

If patches are not yet available, consider implementing input validation or sandboxing the OCCT application to limit the impact of potential denial of service or information disclosure.

Useful 0 Not Useful 0