Autodesk IDrop ActiveX Control Heap Corruption Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Who: Autodesk http://www.autodesk.com What: Autodesk IDrop ActiveX Control http://usa.autodesk.com/adsk/servlet/index?siteID=123112&id=2753219& linkID=9240618 IDrop.ocx version 17.1.51.160 21E0CB95-1198-4945-A3D2-4BF804295F78 How: The Src, Background,...

Autodesk IDrop ActiveX Control Heap Memory Corruption

This module exploits a heap-based memory corruption vulnerability in Autodesk IDrop ActiveX control IDrop.ocx version 17.1.51.160. An attacker can execute arbitrary code by triggering a heap use after free condition using the Src, Background, PackageXml properties. Module Options msf use...

AutoDesk LiveUpdate ActiveX Control ApplyPatch Method Execution

The version of the LiveUpdate ActiveX control, a component included with AutoCAD-based products and installed on the remote Windows host, reportedly allows execution of arbitrary programs via the second argument to the control's 'ApplyPatch' method. If an attacker can trick a user on the affected...

Autodesk LiveUpdate ActiveX Control Code Execution (CVE-2008-4471; CVE-2008-4472)

Autodesk provides several software products for professional designing of buildings and other infrastructure. A code execution vulnerability has been reported in Autodesk LiveUpdate ActiveX control within multiple products. The vulnerability is due to an error in the Autodesk LiveUpdate ActiveX...

CVE-2008-4471

Directory traversal vulnerability in the CExpressViewerControl class in the DWF Viewer ActiveX control AdView.dll 9.0.0.96, as used in Revit Architecture 2009 SP2 and Autodesk Design Review 2009, allows remote attackers to overwrite arbitrary files via ".." sequences in the argument to the SaveAS...

Directory traversal

Directory traversal vulnerability in the CExpressViewerControl class in the DWF Viewer ActiveX control AdView.dll 9.0.0.96, as used in Revit Architecture 2009 SP2 and Autodesk Design Review 2009, allows remote attackers to overwrite arbitrary files via ".." sequences in the argument to the SaveAS...

CVE-2008-4472

The UpdateEngine class in the LiveUpdate ActiveX control LiveUpdate16.DLL 17.2.56, as used in Revit Architecture 2009 SP2 and Autodesk Design Review 2009, allows remote attackers to execute arbitrary programs via the second argument to the ApplyPatch method...

CVE-2008-4471: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in the CExpressViewerControl class in the DWF Viewer ActiveX control AdView.dll 9.0.0.96, as used in Revit Architecture 2009 SP2 and Autodesk Design Review 2009, allows remote attackers to overwrite arbitrary files via ".." sequences in the argument to the SaveAS...

CVE-2008-4472: Undefined Security Weakness

The UpdateEngine class in the LiveUpdate ActiveX control LiveUpdate16.DLL 17.2.56, as used in Revit Architecture 2009 SP2 and Autodesk Design Review 2009, allows remote attackers to execute arbitrary programs via the second argument to the ApplyPatch method...

Autodesk LiveUpdate ActiveX control ApplyPatch method vulnerability

Added: 10/06/2008 CVE: CVE-2008-4472 BID: 31490 OSVDB: 49047 Background Autodesk is a suite of architectural design software products. Problem The ApplyPatch method in the LiveUpdate ActiveX control allows a web page to execute arbitrary files on the system. Remote command execution is possible b...

Autodesk LiveUpdate ActiveX control ApplyPatch method vulnerability

Added: 10/06/2008 CVE: CVE-2008-4472 BID: 31490 OSVDB: 49047 Background Autodesk is a suite of architectural design software products. Problem The ApplyPatch method in the LiveUpdate ActiveX control allows a web page to execute arbitrary files on the system. Remote command execution is possible b...

Autodesk LiveUpdate ActiveX control ApplyPatch method vulnerability

Added: 10/06/2008 CVE: CVE-2008-4472 BID: 31490 OSVDB: 49047 Background Autodesk is a suite of architectural design software products. Problem The ApplyPatch method in the LiveUpdate ActiveX control allows a web page to execute arbitrary files on the system. Remote command execution is possible b...

Autodesk LiveUpdate ActiveX control ApplyPatch method vulnerability

Added: 10/06/2008 CVE: CVE-2008-4472 BID: 31490 OSVDB: 49047 Background Autodesk is a suite of architectural design software products. Problem The ApplyPatch method in the LiveUpdate ActiveX control allows a web page to execute arbitrary files on the system. Remote command execution is possible b...

Autodesk DWF Viewer Control / LiveUpdate Module remote code execution exploit

!-- Autodesk DWF Viewer Control / LiveUpdate Module remote code execution exploit by Nine:Situations:Group::bruiser site: http://retrogod.altervista.org/ tested against IE6 tested software: Revit Architecture 2009 sp2 Autodesk Design Review 2009 which also comes with Revit dll settings both: RegK...

autodesk-exec.txt

!-- Autodesk DWF Viewer Control / LiveUpdate Module remote code execution exploit by Nine:Situations:Group::bruiser site: http://retrogod.altervista.org/ tested against IE6 tested software: Revit Architecture 2009 sp2 Autodesk Design Review 2009 which also comes with Revit dll settings both: RegK...

Autodesk DWF Viewer Control / LiveUpdate Module Remote Exploit

No description provided by source. !-- Autodesk DWF Viewer Control / LiveUpdate Module remote code execution exploit by Nine:Situations:Group::bruiser site: http://retrogod.altervista.org/ tested against IE6 tested software: Revit Architecture 2009 sp2 Autodesk Design Review 2009 which also comes...

Autodesk DWF Viewer Control / LiveUpdate Module - Remote Code Execution

!-- Autodesk DWF Viewer Control / LiveUpdate Module remote code execution exploit by Nine:Situations:Group::bruiser site: http://retrogod.altervista.org/ tested against IE6 tested software: Revit Architecture 2009 sp2 Autodesk Design Review 2009 which also comes with Revit dll settings both: RegK...

Autodesk DWF Viewer Control LiveUpdate Module - Remote Code Execution

Autodesk DWF Viewer Control LiveUpdate Module - Remote Code Execution !-- Autodesk DWF Viewer Control / LiveUpdate Module remote code execution exploit by Nine:Situations:Group::bruiser site: http://retrogod.altervista.org/ tested against IE6 tested software: Revit Architecture 2009 sp2 Autodesk...

Design/Logic Flaw

The cmdjob utility in Autodesk Backburner 3.0.2 allows remote attackers to execute arbitrary commands on render servers by queueing jobs that contain these commands. NOTE: this is only a vulnerability in environments in which the administrator has not followed documentation that outlines the...

CVE-2007-4749

The cmdjob utility in Autodesk Backburner 3.0.2 allows remote attackers to execute arbitrary commands on render servers by queueing jobs that contain these commands. NOTE: this is only a vulnerability in environments in which the administrator has not followed documentation that outlines the...