CVE-2009-3576 Autodesk Softimage 7.x and Softimage XSI 6.x allow remote attackers to execute arbitrary JavaScript code via a scene package containing a Scene Table of Contents (aka .scntoc) file with a Script_Conte...
HighCVSS 9.3
EPSS 3.2%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Autodesk Softimage 7.x and Softimage XSI 6.x allow remote attackers to execute arbitrary JavaScript code via a scene package containing a Scene Table of Contents (aka .scntoc) file with a Script_Content element, as demonstrated by code that loads the WScript.Shell ActiveX control.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| autodesk softimage | = 7.0 | No fix listed |
| autodesk softimage xsi | = 6.0 | No fix listed |
References
- 1023229 vdb-entry
- www.coresecurity.com exploit
- 20091123 CORE-2009-0908: Autodesk SoftImage Scene TOC Arbitrary Command Execution mailing-list
- 36637 vdb-entry