PT-2009-4814 · Awingsoft · Awingsoft Awakening Winds3D Viewer Plugin

Publicado 2009-07-10 · Atualizado 2009-07-13 · CVE-2009-2386

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Awingsoft Awakening Winds3D Viewer plugin versions 3.0.0.5 through 3.5.0.0

Description The issue allows remote attackers to force the download and execution of arbitrary files. This is achieved via the GetURL method, which is used to retrieve files from a remote location.

Recommendations For versions 3.0.0.5 through 3.5.0.0, consider disabling the GetURL method until a patch is available to prevent remote attackers from forcing the download and execution of arbitrary files.

Exploit

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2009-2386

Produtos afetados

Awingsoft Awakening Winds3D Viewer Plugin

Referências · 6

• 🔥 http://securityfocus.com/bid/35595 · Exploit
• 🔥 https://exploit-db.com/exploits/33067 · Exploit
• 🔥 http://coresecurity.com/content/winds3d-viewer-advisory · Exploit
• http://vupen.com/english/advisories/2009/1834 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2009-2386 · Nota de Segurança
• http://secunia.com/advisories/35764 · Aviso do Fabricante