PT-2009-5861 · Autodesk+1 · Autodesk Maya+1

Publicado 2009-11-24 · Atualizado 2018-10-10 · CVE-2009-3578

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Autodesk Maya versions 8.0 through 2010 Autodesk Maya version 2008 Autodesk Maya version 2009 Alias Wavefront Maya version 6.5 Alias Wavefront Maya version 7.0

Description The issue allows remote attackers to execute arbitrary code via a .ma or .mb file that uses the Maya Embedded Language (MEL) python command or other MEL commands, related to Script Nodes.

Recommendations For Autodesk Maya versions 8.0 through 2010, consider disabling the use of MEL python commands in .ma and .mb files until a fix is available. For Autodesk Maya version 2008, avoid using Script Nodes in .ma and .mb files. For Autodesk Maya version 2009, restrict access to MEL commands to minimize the risk of exploitation. For Alias Wavefront Maya version 6.5, consider disabling the execution of MEL commands in .ma and .mb files. For Alias Wavefront Maya version 7.0, limit the use of Script Nodes to trusted sources.

Exploit

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2009-3578

Produtos afetados

Alias Wavefront Maya

Autodesk Maya

Referências · 6

• 🔥 https://exploit-db.com/exploits/10213 · Exploit
• http://securitytracker.com/id?1023228 · Nota
• http://coresecurity.com/content/maya-arbitrary-command-execution · Nota
• http://securityfocus.com/archive/1/508013/100/0/threaded · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2009-3578 · Nota de Segurança
• http://securityfocus.com/bid/36636 · Nota