PT-2009-5859 · Autodesk · Autodesk Softimage

Publicado 2009-11-24 · Atualizado 2018-10-10 · CVE-2009-3576

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Autodesk Softimage versions 7.x Autodesk Softimage XSI versions 6.x

Description The issue allows remote attackers to execute arbitrary JavaScript code via a scene package containing a Scene Table of Contents (aka .scntoc) file with a Script Content element. This can be demonstrated by code that loads the WScript.Shell ActiveX control.

Recommendations For Autodesk Softimage version 7.x, update to a version that fixes this issue. For Autodesk Softimage XSI version 6.x, update to a version that fixes this issue. As a temporary workaround, consider restricting the use of scene packages from untrusted sources to minimize the risk of exploitation.

Exploit

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2009-3576

Produtos afetados

Autodesk Softimage

Referências · 7

• 🔥 http://coresecurity.com/content/softimage-arbitrary-command-execution · Exploit
• 🔥 https://exploit-db.com/exploits/33273 · Exploit
• 🔥 https://exploit-db.com/exploits/10211 · Exploit
• http://securitytracker.com/id?1023229 · Nota
• http://securityfocus.com/bid/36637 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2009-3576 · Nota de Segurança
• http://securityfocus.com/archive/1/508011/100/0/threaded · Nota