CVE-2021-31485

Vulnerability

A heap-based buffer overflow exists in OpenText Brava! Desktop version 16.6.3.84 within the parsing of DWF files. The flaw originates from the lack of proper validation of the length of user-supplied data before copying it into a fixed-length heap-based buffer. This vulnerability is reachable when a user opens a specially crafted DWF file or visits a malicious page that triggers the parsing.[1]

Exploitation

To exploit this vulnerability, an attacker must convince the target to open a malicious DWF file or navigate to a crafted web page that triggers the parsing within Brava! Desktop. No special privileges or network position beyond user interaction is required. The attacker supplies oversized data in the DWF file that, when processed, overflows a heap buffer.[1]

Impact

Successful exploitation allows the attacker to execute arbitrary code in the context of the current process (the Brava! Desktop application). This can lead to full compromise of confidentiality, integrity, and availability of the user's data and system, operating with the privileges of the logged-in user.[1]

Mitigation

The advisory from ZDI was published on June 2, 2021, but does not specify a fixed version or release date. As of the publication date, no official patch or workaround is disclosed in the available references. Users should monitor vendor updates for a patched version of Brava! Desktop.[1]