Wednesday, October 16, 2024
HomeAdobeAdobe Substance 3D Stager Let Attacker Execute Arbitrary Code

Adobe Substance 3D Stager Let Attacker Execute Arbitrary Code

Published on

Malware protection

Adobe has released a security update that fixes “Important-severity” vulnerabilities in its Substance 3D Stager product. The successful exploitation of these issues could result in a memory leak and arbitrary code execution in the current user’s context.

Adobe Substance 3D Stager is a cutting-edge staging tool for creating 3D scenes using real-time 3D visualization and high-quality renderings.

At the time of release, none of the flaws that Adobe patched this month were known to the public or targeted by active attacks. These upgrades have a deployment priority rating of 3, according to Adobe. 

- Advertisement - SIEM as a Service
Document
Free Webinar

Fastrack Compliance: The Path to ZERO-Vulnerability

Compounding the problem are zero-day vulnerabilities like the MOVEit SQLi, Zimbra XSS, and 300+ such vulnerabilities that get discovered each month. Delays in fixing these vulnerabilities lead to compliance issues, these delay can be minimized with a unique feature on AppTrana that helps you to get “Zero vulnerability report” within 72 hours.

Vulnerabilities Addressed

Six security vulnerabilities in Adobe’s Substance 3D Stager product have been patched, such as:

The Out-of-bounds Read categories CVE-2024-20710, CVE-2024-20711, CVE-2024-20712, CVE-2024-20714, and CVE-2024-20715 have a severity rating of “Important” with a CVSS base score of 5.5.

These vulnerabilities enable a remote attacker to obtain access to potentially sensitive information.

The vulnerability exists because of a boundary condition. A remote attacker can generate a specially crafted file, mislead the victim into opening it, cause an out-of-bounds read error, and read memory from the system.

The CVE-2024-20713 with Improper Input Validation category has a CVSS base score of 5.5, allowing a remote attacker to access the compromised machine.

The insufficient validation of user-supplied input is the cause of the vulnerability. A remote attacker can take control of the system and run arbitrary code by tricking the user into opening a maliciously created file.

Vulnerability CategoryVulnerability ImpactSeverityCVSS base score CVE Numbers 
Out-of-bounds Read (CWE-125)Memory leakImportant5.5CVE-2024-20710
Out-of-bounds Read (CWE-125)Memory leakImportant5.5CVE-2024-20711
Out-of-bounds Read (CWE-125)Memory leakImportant5.5CVE-2024-20712
Improper Input Validation (CWE-20)Arbitrary code executionImportant5.5CVE-2024-20713
Out-of-bounds Read (CWE-125)Memory leakImportant5.5CVE-2024-20714
Out-of-bounds Read (CWE-125)Memory leakImportant5.5CVE-2024-20715

Affected Versions

Adobe Substance 3D Stager 2.1.3 and earlier versions

Platforms: Windows and macOS

Update Now

Upgrade to the Substance 3D Stager version 2.1.4

“Adobe categorizes these updates with the following priority ratings and recommends users update their installation to the newest version via the Creative Cloud desktop app’s update mechanism,” the company said.

Gurubaran
Gurubaran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Latest articles

HORUS Protector Delivering AgentTesla, Remcos, Snake, NjRat Malware

The Horus Protector crypter is being used to distribute various malware families, including AgentTesla,...

ErrorFather Hackers Attacking & Control Android Device Remotely

The Cerberus Android banking trojan, which gained notoriety in 2019 for its ability to...

Hackers Allegedly Selling Data Stolen from Cisco

A group of hackers reportedly sells sensitive data stolen from Cisco Systems, Inc.The...

Fortigate SSLVPN Vulnerability Exploited in the Wild

A critical vulnerability in Fortinet's FortiGate SSLVPN appliances, CVE-2024-23113, has been actively exploited in...

Free Webinar

Protect Websites & APIs from Malware Attack

Malware targeting customer-facing websites and API applications poses significant risks, including compliance violations, defacements, and even blacklisting.

Join us for an insightful webinar featuring Vivek Gopalan, VP of Products at Indusface, as he shares effective strategies for safeguarding websites and APIs against malware.

Discussion points

Scan DOM, internal links, and JavaScript libraries for hidden malware.
Detect website defacements in real time.
Protect your brand by monitoring for potential blacklisting.
Prevent malware from infiltrating your server and cloud infrastructure.

More like this

HORUS Protector Delivering AgentTesla, Remcos, Snake, NjRat Malware

The Horus Protector crypter is being used to distribute various malware families, including AgentTesla,...

ErrorFather Hackers Attacking & Control Android Device Remotely

The Cerberus Android banking trojan, which gained notoriety in 2019 for its ability to...

Hackers Allegedly Selling Data Stolen from Cisco

A group of hackers reportedly sells sensitive data stolen from Cisco Systems, Inc.The...