==========================================================================
Two Vulnerabilities of AutoCAD: CVE-2014-0818 and CVE-2014-0819
  Mar 16, 2014
  @kaito834
==========================================================================

------------------------
Overview
------------------------

AutoCAD 2013 and earlier version contained untrusted search path vulnerabilities.
When the AutoCAD load FAS or DLL file, the AutoCAD search these files on current 
working directory. Therefore, attacker or malware could load own FAS or DLL　file
when AutoCAD user opened DWG file on a directory stored these DLL or FAS file.
The vendor, Autodesk, Inc, fixed these vulnerabilities in AutoCAD 2014.

These vulnerabilities were assigned CVE-2014-0818 and CVE-2014-0819.

CVE-2014-0818/JVN#33382534
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0818
https://jvn.jp/en/jp/JVN33382534/

CVE-2014-0819/JVN#43254599
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0819
https://jvn.jp/en/jp/JVN43254599/

------------------------
Background
------------------------

On June 2012, ESET posted blog entry (*1) about ACAD/Medre.A, a worm written in
AutoLISP. The blog entry explained the malware abused automatic loading of
AutoLISP routines. I interested in search path of AutoCAD and consulted AutoCAD
official document. And, I confirmed that AutoCAD search AutoLisp code firstly
on current working directory (*2) if AutoLisp code was loaded by only filename.

As a result, I wrote a Proof of Concept based the ESET blog entry and reported
malware issue as untrusted search path vulnerability to IPA (*3).

(*1): http://www.welivesecurity.com/2012/06/21/acadmedre-a-technical-analysis-2/
(*2): http://exchange.autodesk.com/autocad/online-help/browse#WS73099cc142f4875516d84be10ebc87a53f-7872.htm (Japanese)
(*3): INFORMATION-TECHNOLOGY PROMOTION AGENCY, JAPAN
      http://www.ipa.go.jp/security/english/third.html

------------------------
Procedure for reproducing issue
------------------------

I confirmed this procedure on AutoCAD 2013, version G.55.0.0.

(1) Launch AutoCAD 2013 and saved empty dimensional design data as
    Drawing1.dwg. Then, store the Drawing1.dwg with PoC code,
    Acad.fas (*4), on C:\exploit.
    http://f.hatena.ne.jp/kaito834/20140222203210

(2) After Process Monitor (*5) is launched, open Drawing1.dwg by double-click.

(3) Launched AutoCAD 2013, and launched calc.exe at same time.
    http://f.hatena.ne.jp/kaito834/20140222203211

    Then, look up Process Monitor and you can confirm that Acad.fas is loaded
    on current working directory stored Drawing1.dwg.
    http://f.hatena.ne.jp/kaito834/20140222203212

    And, look up [Event Properties] - [Stack] of Process Monitor and
    you can see that accore.dll load Acad.fas.
    http://f.hatena.ne.jp/kaito834/20140222203213

(*4): PoC code is not explained this advisory. Please contact to me
      if you were interested in PoC.
(*5): http://technet.microsoft.com/en-us/sysinternals/bb896645.aspx

------------------------
Timeline
------------------------

Jul  3, 2012   I reported the vulnerability to IPA by email, and
               IPA responded that we received the vulnerability report.
Aug  6, 2012   IPA informed me that we confirmed the report and submitted
               to vendor, Autodesk, Inc, by email.
mid-Aug 2012   The vendor released AudoCAD 2013 Service Pack 1(SP1)
               that provided new security feature; see Reference.               
Apr  4, 2013   I inquired at IPA whether the vunlerability was fixed
               or not by email.
Apr 18, 2013   IPA answered to me that the vendor released SP1 and
               would fix the vulnerability in the future by email.
May 11, 2013   I inquired at IPA whether CVE-2014-0818 was fixed, and
               CVE-2014-0819 was not fixed by email.
May 22, 2013   IPA answered to me that CVE-2014-0818 and CVE-2014-0819
               were not fixed, and would be fixed in the future by email.
Aug 22, 2013   I inquired at IPA whether the vulnerability and CVE-2013-3665
               were different or not by email.
               https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-3665
Sep  4, 2013   IPA responded to me that we were waiting for reply from 
               vendor by email.
mid-Sep 2013   IPA answered to me that the vulnerability and CVE-2013-3665
               were different by email.
Feb 21, 2014   The vendor fixed CVE-2014-0818 and CVE-2014-0819, and
               IPA puslished the advisories: JVN#33382534 and JVN#43254599.

------------------------
Reference
------------------------

* Hatena Diary(my blog post in Japanse)
http://d.hatena.ne.jp/kaito834/20140223/1393145077

* Autodesk, Inc
http://knowledge.autodesk.com/support/autocad/troubleshooting/caas/sfdcarticles/sfdcarticles/AutoLISP-and-VBA-Security-Controls-in-AutoCAD-2013-SP1.html

* Vulnerability related to CVE-2014-0818
http://cve.mitre.org/cgi-bin/cvename.cgi?name=2011-3360
http://www.exploit-db.com/exploits/18125/

==========================================================================