Google SketchUp '.SKP' File Invalid Edge Geometry Remote Code Execution Vulnerability

Bugtraq ID:	48363
Class:	Unknown
CVE:	CVE-2011-2478
Remote:	Yes
Local:	No
Published:	Jun 21 2011 12:00AM
Updated:	Jun 21 2011 12:00AM
Credit:	David Weston of Microsoft.
Vulnerable:	Google Sketchup 7.0.10247 Google Sketchup 7.1.Maintenance Rele
Not Vulnerable:	Google Sketchup 8

Google SketchUp '.SKP' File Invalid Edge Geometry Remote Code Execution Vulnerability

Google SketchUp is prone to a remote code-execution vulnerability.

Attackers may exploit this issue to execute arbitrary code in the context of the application. Failed attacks will cause denial-of-service conditions.

Google SketchUp 7.1 Maintenance Release 2 and prior are vulnerable.

Google SketchUp '.SKP' File Invalid Edge Geometry Remote Code Execution Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Google SketchUp '.SKP' File Invalid Edge Geometry Remote Code Execution Vulnerability

Solution:
Updates are available. Please see the references for more information.

Google SketchUp '.SKP' File Invalid Edge Geometry Remote Code Execution Vulnerability

References:

• Google SketchUp 8 Release Notes (Google)
  
• Google SketchUp Homepage (Google)
  
• Microsoft Vulnerability Research Advisory MSVR11-006 (Microsoft)