Autodesk IDrop ActiveX Control Heap Memory Corruption

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class MetasploitModule 'Autodesk IDrop ActiveX Control Heap Memory Corruption', 'Description' = %q This module exploits a heap-based memory corruption...

CVE-2009-3576

Autodesk Softimage 7.x and Softimage XSI 6.x allow remote attackers to execute arbitrary JavaScript code via a scene package containing a Scene Table of Contents aka .scntoc file with a ScriptContent element, as demonstrated by code that loads the WScript.Shell ActiveX control...

Command injection

Autodesk Maya 8.0, 8.5, 2008, 2009, and 2010 and Alias Wavefront Maya 6.5 and 7.0 allow remote attackers to execute arbitrary code via a 1 .ma or 2 .mb file that uses the Maya Embedded Language MEL python command or unspecified other MEL commands, related to "Script Nodes."...

CVE-2009-3577

Autodesk 3D Studio Max 3DSMax 6 through 9 and 2008 through 2010 allows remote attackers to execute arbitrary code via a .max file with a MAXScript statement that calls the DOSCommand method, related to "application callbacks."...

CVE-2009-3576

Autodesk Softimage (Softimage 7.x; Softimage XSI 6.x) is affected by CVE-2009-3576. The vulnerability arises from Scene TOC (.scntoc) XML files that Softimage loads automatically; a Script_Content element within a crafted .scntoc can execute arbitrary code via WScript.Shell/ADODB.Stream without u...

CVE-2009-3577

Autodesk 3DS Max applications (versions 6–9 and 2008–2010) are affected by a vulnerability in MaxScript application callbacks that allows remote code execution when a crafted .max file embeds a MAXScript statement invoking DOSCommand. Root cause: unsanitized data binding of MaxScript to callbacks...

CVE-2009-3576

Autodesk Softimage 7.x and Softimage XSI 6.x allow remote attackers to execute arbitrary JavaScript code via a scene package containing a Scene Table of Contents aka .scntoc file with a ScriptContent element, as demonstrated by code that loads the WScript.Shell ActiveX control...

CVE-2009-3578

CVE-2009-3578 affects Autodesk Maya (versions 8.0/8.5/2008/2009/2010) and Alias Wavefront Maya 6.5–7.0. The vulnerability arises from Script Nodes that can contain MEL or Python code embedded in .ma/.mb scene files. Opening such a file can cause arbitrary code execution under the user’s privilege...

CVE-2009-3578

Autodesk Maya 8.0, 8.5, 2008, 2009, and 2010 and Alias Wavefront Maya 6.5 and 7.0 allow remote attackers to execute arbitrary code via a 1 .ma or 2 .mb file that uses the Maya Embedded Language MEL python command or unspecified other MEL commands, related to "Script Nodes."...

CVE-2009-3577

Autodesk 3D Studio Max 3DSMax 6 through 9 and 2008 through 2010 allows remote attackers to execute arbitrary code via a .max file with a MAXScript statement that calls the DOSCommand method, related to "application callbacks."...

Autodesk 3ds Max应用回调远程代码执行漏洞

BUGTRAQ ID: 36634 CVE ID: CVE-2009-3577 Autodesk 3D Max是在视频游戏、电影、多媒体和web内容开发中广泛应用的建模和动画软件包。 Autodesk 3D Max提供了内嵌的脚本语言MaxScript。3D Max允许用户将MaxScript绑定到应用回调上，如果用户受骗打开了嵌入有MaxScript应用回调的.max文件，就会导致执行任意代码。 Autodesk 3DS Max 9 Autodesk 3DS Max 8 Autodesk 3DS Max 7 Autodesk 3DS Max 6 Autodesk 3DS Max 201...

Autodesk SoftImage Scene TOC文件处理远程代码执行漏洞

BUGTRAQ ID: 36637 CVE ID: CVE-2009-3576 Autodesk Softimage是用于生成3D图形、3D模型和动画的图形应用程序。 Softimage默认会保持带有场景内容树的场景目录（.scntoc）文件。场景目录文件是包含有场景信息的XML文件，Softimage会查找相关的场景目录文件并应用其中的信息。用户可以编辑特制的.scntoc文件，加载了该文件后无需用户干涉就可以自动执行脚本。 Autodesk SoftImage XSI 6.x Autodesk SoftImage 7.x 临时解决方法： 通过以下步骤禁止自动读取SCTOC脚本：...

Autodesk Maya脚本节点文件远程代码执行漏洞

BUGTRAQ ID: 36636 CVE ID: CVE-2009-3578 Maya是一款高端的3D计算机图形和3D建模软件包。 Maya提供了被称为“脚本节点”的方式用于使用MEL（Maya的专有编程语言）和Python对动画行为进行编程。脚本节点保存为.mb和.ma文件格式。通过使用嵌入有脚本节点的特制文件，用户打开恶意的场景文件后就会无需任何干涉便可执行任意命令。 Autodesk Maya 8.5 Autodesk Maya 8.0 Autodesk Maya 2010 Autodesk Maya 2009 Autodesk Maya 2008 临时解决方法：...

Autodesk 3DS Max Application Callbacks Arbitrary Command Execution

Autodesk 3DS Max Application Callbacks Arbitrary Command Execution. CVE-2009-3577. Local exploit for windows platform -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Core Security Technologies - CoreLabs Advisory http://www.coresecurity.com/corelabs/ Autodesk 3DS Max Application Callbacks Arbitrary...

Autodesk 3DS Max Application Callbacks Arbitrary Command Execution

Advisory ID Internal CORE-2009-0909 Core Security - CoreLabs Autodesk 3DS Max Application Callbacks Arbitrary Command Execution 1. Advisory Information Title: Autodesk 3DS Max Application Callbacks Arbitrary Command Execution Advisory Id: CORE-2009-0909 Advisory...

Autodesk 3DS Max Application Callbacks Arbitrary Command Execution

No description provided by source. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Core Security Technologies - CoreLabs Advisory http://www.coresecurity.com/corelabs/ Autodesk 3DS Max Application Callbacks Arbitrary Command Execution 1. Advisory Information Title: Autodesk 3DS Max Application...

Autodesk SoftImage Scene TOC Arbitrary Command Execution

Advisory ID Internal CORE-2009-0908 1. Advisory Information Title: Autodesk SoftImage Scene TOC Arbitrary Command Execution Advisory Id: CORE-2009-0908 Advisory URL:http://www.coresecurity.com/content/softimage-arbitrary-command-execution Date published: 2009-11-23 Date of last update: 2009-11-20...

Autodesk SoftImage Scene TOC - Arbitrary Command Execution

Autodesk SoftImage Scene TOC - Arbitrary Command Execution -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Core Security Technologies - CoreLabs Advisory http://www.coresecurity.com/corelabs/ Autodesk SoftImage Scene TOC Arbitrary Command Execution 1. Advisory Information Title: Autodesk SoftImage...

Autodesk Maya Script Nodes Arbitrary Command Execution

Advisory ID Internal CORE-2009-0910 1. Advisory Information Title: Autodesk Maya Script Nodes Arbitrary Command Execution Advisory Id: CORE-2009-0910 Advisory URL:http://www.coresecurity.com/content/maya-arbitrary-command-execution Date published: 2009-11-23 Date of last update: 2009-11-20 Vendor...

Autodesk 3DS Max Application Callbacks Arbitrary Command Execution

Exploit for unknown platform in category local exploits ================================================================== Autodesk 3DS Max Application Callbacks Arbitrary Command Execution ================================================================== Title: Autodesk 3DS Max Application...