PT-2009-5859 · Autodesk · Autodesk Softimage

Published 2009-11-24 · Updated 2018-10-10 · CVE-2009-3576

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Autodesk Softimage versions 7.x Autodesk Softimage XSI versions 6.x

Description The issue allows remote attackers to execute arbitrary JavaScript code via a scene package containing a Scene Table of Contents (aka .scntoc) file with a Script Content element. This can be demonstrated by code that loads the WScript.Shell ActiveX control.

Recommendations For Autodesk Softimage version 7.x, update to a version that fixes this issue. For Autodesk Softimage XSI version 6.x, update to a version that fixes this issue. As a temporary workaround, consider restricting the use of scene packages from untrusted sources to minimize the risk of exploitation.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2009-3576

Affected Products

Autodesk Softimage

References · 7

• 🔥 http://coresecurity.com/content/softimage-arbitrary-command-execution · Exploit
• 🔥 https://exploit-db.com/exploits/33273 · Exploit
• 🔥 https://exploit-db.com/exploits/10211 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-3576 · Security Note
• http://securitytracker.com/id?1023229 · Note
• http://securityfocus.com/bid/36637 · Note
• http://securityfocus.com/archive/1/508011/100/0/threaded · Note