CVE-2009-3577

Autodesk 3D Studio Max 3DSMax 6 through 9 and 2008 through 2010 allows remote attackers to execute arbitrary code via a .max file with a MAXScript statement that calls the DOSCommand method, related to "application callbacks."...

CVE-2009-3577

Autodesk 3DS Max applications (versions 6–9 and 2008–2010) are affected by a vulnerability in MaxScript application callbacks that allows remote code execution when a crafted .max file embeds a MAXScript statement invoking DOSCommand. Root cause: unsanitized data binding of MaxScript to callbacks...

CVE-2009-3576

Autodesk Softimage (Softimage 7.x; Softimage XSI 6.x) is affected by CVE-2009-3576. The vulnerability arises from Scene TOC (.scntoc) XML files that Softimage loads automatically; a Script_Content element within a crafted .scntoc can execute arbitrary code via WScript.Shell/ADODB.Stream without u...

CVE-2009-3576

Autodesk Softimage 7.x and Softimage XSI 6.x allow remote attackers to execute arbitrary JavaScript code via a scene package containing a Scene Table of Contents aka .scntoc file with a ScriptContent element, as demonstrated by code that loads the WScript.Shell ActiveX control...

CVE-2009-3577

Autodesk 3D Studio Max 3DSMax 6 through 9 and 2008 through 2010 allows remote attackers to execute arbitrary code via a .max file with a MAXScript statement that calls the DOSCommand method, related to "application callbacks."...

CVE-2009-3578

CVE-2009-3578 affects Autodesk Maya (versions 8.0/8.5/2008/2009/2010) and Alias Wavefront Maya 6.5–7.0. The vulnerability arises from Script Nodes that can contain MEL or Python code embedded in .ma/.mb scene files. Opening such a file can cause arbitrary code execution under the user’s privilege...

CVE-2009-3578

Autodesk Maya 8.0, 8.5, 2008, 2009, and 2010 and Alias Wavefront Maya 6.5 and 7.0 allow remote attackers to execute arbitrary code via a 1 .ma or 2 .mb file that uses the Maya Embedded Language MEL python command or unspecified other MEL commands, related to "Script Nodes."...

Autodesk SoftImage Scene TOC文件处理远程代码执行漏洞

BUGTRAQ ID: 36637 CVE ID: CVE-2009-3576 Autodesk Softimage是用于生成3D图形、3D模型和动画的图形应用程序。 Softimage默认会保持带有场景内容树的场景目录（.scntoc）文件。场景目录文件是包含有场景信息的XML文件，Softimage会查找相关的场景目录文件并应用其中的信息。用户可以编辑特制的.scntoc文件，加载了该文件后无需用户干涉就可以自动执行脚本。 Autodesk SoftImage XSI 6.x Autodesk SoftImage 7.x 临时解决方法： 通过以下步骤禁止自动读取SCTOC脚本：...

Autodesk 3ds Max应用回调远程代码执行漏洞

BUGTRAQ ID: 36634 CVE ID: CVE-2009-3577 Autodesk 3D Max是在视频游戏、电影、多媒体和web内容开发中广泛应用的建模和动画软件包。 Autodesk 3D Max提供了内嵌的脚本语言MaxScript。3D Max允许用户将MaxScript绑定到应用回调上，如果用户受骗打开了嵌入有MaxScript应用回调的.max文件，就会导致执行任意代码。 Autodesk 3DS Max 9 Autodesk 3DS Max 8 Autodesk 3DS Max 7 Autodesk 3DS Max 6 Autodesk 3DS Max 201...

CVE-2009-3577: Improper Control of Generation of Code

Autodesk 3D Studio Max 3DSMax 6 through 9 and 2008 through 2010 allows remote attackers to execute arbitrary code via a .max file with a MAXScript statement that calls the DOSCommand method, related to "application callbacks."...

CVE-2009-3576: Improper Control of Generation of Code

Autodesk Softimage 7.x and Softimage XSI 6.x allow remote attackers to execute arbitrary JavaScript code via a scene package containing a Scene Table of Contents aka .scntoc file with a ScriptContent element, as demonstrated by code that loads the WScript.Shell ActiveX control...

CVE-2009-3578: Improper Control of Generation of Code

Autodesk Maya 8.0, 8.5, 2008, 2009, and 2010 and Alias Wavefront Maya 6.5 and 7.0 allow remote attackers to execute arbitrary code via a 1 .ma or 2 .mb file that uses the Maya Embedded Language MEL python command or unspecified other MEL commands, related to "Script Nodes."...

Autodesk Maya脚本节点文件远程代码执行漏洞

BUGTRAQ ID: 36636 CVE ID: CVE-2009-3578 Maya是一款高端的3D计算机图形和3D建模软件包。 Maya提供了被称为“脚本节点”的方式用于使用MEL（Maya的专有编程语言）和Python对动画行为进行编程。脚本节点保存为.mb和.ma文件格式。通过使用嵌入有脚本节点的特制文件，用户打开恶意的场景文件后就会无需任何干涉便可执行任意命令。 Autodesk Maya 8.5 Autodesk Maya 8.0 Autodesk Maya 2010 Autodesk Maya 2009 Autodesk Maya 2008 临时解决方法：...

Autodesk SoftImage Scene TOC Arbitrary Command Execution

Advisory ID Internal CORE-2009-0908 1. Advisory Information Title: Autodesk SoftImage Scene TOC Arbitrary Command Execution Advisory Id: CORE-2009-0908 Advisory URL:http://www.coresecurity.com/content/softimage-arbitrary-command-execution Date published: 2009-11-23 Date of last update: 2009-11-20...

Autodesk 3DS Max Application Callbacks Arbitrary Command Execution

Exploit for unknown platform in category local exploits ================================================================== Autodesk 3DS Max Application Callbacks Arbitrary Command Execution ================================================================== Title: Autodesk 3DS Max Application...

Autodesk 3DS Max Application Callbacks Arbitrary Command Execution

No description provided by source. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Core Security Technologies - CoreLabs Advisory http://www.coresecurity.com/corelabs/ Autodesk 3DS Max Application Callbacks Arbitrary Command Execution 1. Advisory Information Title: Autodesk 3DS Max Application...

Autodesk 3DS Max Application Callbacks Arbitrary Command Execution

Autodesk 3DS Max Application Callbacks Arbitrary Command Execution. CVE-2009-3577. Local exploit for windows platform -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Core Security Technologies - CoreLabs Advisory http://www.coresecurity.com/corelabs/ Autodesk 3DS Max Application Callbacks Arbitrary...

Autodesk SoftImage Scene TOC - Arbitrary Command Execution

Autodesk SoftImage Scene TOC - Arbitrary Command Execution -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Core Security Technologies - CoreLabs Advisory http://www.coresecurity.com/corelabs/ Autodesk SoftImage Scene TOC Arbitrary Command Execution 1. Advisory Information Title: Autodesk SoftImage...

Autodesk Maya Script Nodes Arbitrary Command Execution

Advisory ID Internal CORE-2009-0910 1. Advisory Information Title: Autodesk Maya Script Nodes Arbitrary Command Execution Advisory Id: CORE-2009-0910 Advisory URL:http://www.coresecurity.com/content/maya-arbitrary-command-execution Date published: 2009-11-23 Date of last update: 2009-11-20 Vendor...

Autodesk 3DS Max Application Callbacks Arbitrary Command Execution

Advisory ID Internal CORE-2009-0909 Core Security - CoreLabs Autodesk 3DS Max Application Callbacks Arbitrary Command Execution 1. Advisory Information Title: Autodesk 3DS Max Application Callbacks Arbitrary Command Execution Advisory Id: CORE-2009-0909 Advisory...