critical9.3Public exploit code
CVE-2009-3576
Autodesk Softimage 7.x and Softimage XSI 6.x allow remote attackers to execute arbitrary JavaScript code via a scene package containing a Scene Table of Conten…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Autodesk SoftImage 7.0 Scene - '.TOC' File Remote Code Execution2009-11-23 · remote · windows · Verified
- Autodesk SoftImage Scene TOC - Arbitrary Command Execution2009-11-23 · local · windows · Verified
Impact
Autodesk Softimage 7.x and Softimage XSI 6.x allow remote attackers to execute arbitrary JavaScript code via a scene package containing a Scene Table of Contents (aka .scntoc) file with a Script_Content element, as demonstrated by code that loads the WScript.Shell ActiveX control.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Autodesk | Autodesk Softimage | Version 7.0 |
| Autodesk | Autodesk Softimage Xsi | Version 6.0 |
Weakness classification
References
- NVD record
- CVE.org record
- http://securitytracker.com/id?1023229
- http://www.coresecurity.com/content/softimage-arbitrary-command-execution
- http://www.securityfocus.com/archive/1/508011/100/0/threaded
- http://www.securityfocus.com/bid/36637
- http://securitytracker.com/id?1023229
- http://www.coresecurity.com/content/softimage-arbitrary-command-execution
- http://www.securityfocus.com/archive/1/508011/100/0/threaded
- http://www.securityfocus.com/bid/36637