CVE-2020-28598 : Security Advisory and Response

An out-of-bounds write vulnerability in Prusa Research PrusaSlicer 2.2.0 and Master (commit 4b040b856) can lead to code execution when processing a specially crafted AMF file.

Understanding CVE-2020-28598

This CVE involves a high-severity vulnerability in Prusa Research PrusaSlicer software.

What is CVE-2020-28598?

The vulnerability allows an attacker to execute arbitrary code by providing a malicious file to the affected software.

The Impact of CVE-2020-28598

CVSS Base Score: 8.8 (High)
Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
User Interaction: Required
Confidentiality, Integrity, and Availability Impact: High

Technical Details of CVE-2020-28598

This section provides detailed technical information about the vulnerability.

Vulnerability Description

The vulnerability exists in the Admesh stl_fix_normal_directions() function of PrusaSlicer, allowing an out-of-bounds write.

Affected Systems and Versions

Affected Product: Prusa Research
Affected Versions:
Prusa Research PrusaSlicer 2.2.0
Prusa Research PrusaSlicer Master (commit 4b040b856)

Exploitation Mechanism

A specially crafted AMF file triggers the vulnerability, enabling an attacker to achieve code execution.

Mitigation and Prevention

Protect your systems from CVE-2020-28598 with these mitigation strategies.

Immediate Steps to Take

Update PrusaSlicer to a patched version.
Avoid opening files from untrusted sources.
Monitor network traffic for suspicious activities.

Long-Term Security Practices

Regularly update software and firmware.
Conduct security assessments and audits.
Educate users on safe computing practices.

Patching and Updates

Apply security patches provided by Prusa Research to address the vulnerability.