Question 1

What type of vulnerability was addressed in this update?

Accepted Answer

An input string validation issue was identified that could lead to Remote Code Execution (RCE), allowing an attacker to potentially execute code remotely in the user’s computer.

Question 2

Does this vulnerability affect built games/applications in any way?

Accepted Answer

No. Only the Unity Editor is affected.

Question 3

What platforms are affected?

Accepted Answer

Windows only. Mac and Linux platforms are not affected by the identified vulnerability.

Question 4

What versions of Windows are affected?

Accepted Answer

All versions of Windows.

Question 5

What versions of Unity are affected?

Accepted Answer

All versions of the Unity Editor running on Windows.

Question 6

What versions of the Unity Editor are being patched?

Accepted Answer

We have released a patch for the latest Unity Editor versions of 5.6 and all officially supported versions up to 2019.2 Alpha. All future versions will contain the update as well.

Question 7

Will my specific version be patched?

Accepted Answer

Unity will be releasing a single patch to each of the most current, i.e., last update of the Unity Editor.

Question 8

What about versions older than 5.6?

Accepted Answer

We are providing a mitigation tool that disables the identified vulnerable feature of the Unity Editor which can be downloaded from the Mitigation Tool Guide [7].
Please take into account that the mitigation is not a patch and has limitations. The mitigation will disable the Unity Editor feature identified as vulnerable, but since we can not control whether the affected functionality becomes re-enabled at some point after applying the mitigation, we strongly recommend updating to a fixed version of the Unity Editor to get the benefits of the full patch. You will also no longer be able to use the ‘Open in Unity’ functionality in the web browser version of the Asset Store after applying the mitigation.

Question 9

Does the mitigation tool work for versions newer than 5.6? Can I use the mitigation tool instead of patching?

Accepted Answer

The mitigation tool can be used on all affected versions of the Unity Editor.
Please take into account that the mitigation is not a patch and has limitations. The mitigation will disable the Unity Editor feature identified as vulnerable, but since we can not control whether the affected functionality becomes re-enabled at some point after applying the mitigation, we strongly recommend updating to a fixed version of the Unity Editor to get the benefits of the full patch. You will also no longer be able to use the ‘Open in Unity’ functionality in the web browser version of the Asset Store after applying the mitigation.

Question 10

I run multiple versions of Unity, do I have to apply the mitigation tool for all of them?

Accepted Answer

No, by running it once it deactivates the identified vulnerable component across all of them. Do keep in mind that by re-installing or updating (one) of the versions, it may activate the component again. To check, re-run the workaround tool until all versions are up to date.

Question 11

Can I just use the mitigation tool and never move to a patched version?

Accepted Answer

The mitigation will disable the Unity Editor feature identified as vulnerable, but since we can not control whether the affected functionality becomes re-enabled at some point after applying the mitigation, we strongly recommend updating to a fixed version of the Unity Editor to get the benefits of the full patch. You will also no longer be able to use the ‘Open in Unity’ functionality in the web browser version of the Asset Store after applying the mitigation.

Question 12

I have a locked-down older version of Unity 5.x.x. Will you produce a patch for the exact version of Unity that I’m using?

Accepted Answer

Our focus right now is on addressing the identified vulnerability in 5.6 and all officially supported versions up to 2019.2 Alpha. We do not have any details to share on patches for other versions at this time.

Question 13

Will I need to rebuild asset bundles due to the update requirement?

Accepted Answer

It depends on the specific version of the Unity Editor that you are using. Most customers will be able to update to the patched versions without needing to rebuild their bundles, but some customers may find that asset importers have been updated between the version they are currently using and the patch for that dot-release. For those customers, asset bundle rebuilding may be necessary.

Question 14

How do I know if I’ll need to rebuild my asset bundles?

Accepted Answer

You may need to rebuild your bundles if any assets are re-imported when you first open your project in the patched version of the Unity Editor.

2019년 3월 보안 업데이트 권고(CVE-2019-9197)

취약점 세부 정보

문제 해결 단계

Unity 에디터 버전 확인

업데이트 설치

완화 툴

FAQ

참조