Blender 2.49b - .blend Remote Command Execution

An attacker can exploit this issue by enticing an unsuspecting victim to open a specially crafted '.blend' file. 

The following proof of concept demonstrates this issue: 

. Open the "Text Editor" Panel.
. Right click on the canvas and select "New".
. Write your python code there. For instance:

/-----
import os
os.system("calc.exe")
-----/

. In the text name field (TX:Text.001) input a name for your
script, e.g.: TX:myscript.
. Open the "Buttons Window" panel.
. From the "panel" dropdown choose "Script".
. Check that "enable script links" is active.
. Click on "new".
. Select the script you created (e.g. myscript).
. Choose "OnLoad" from the event dropdown list.
. In the "User Preferences" panel, select File->Save, and save your project.


NOTE: Core Security Technologies has developed a working commercial exploit for its CORE IMPACT product. This exploit is not otherwise publicly available or known to be circulating in the wild.