: Core asks Autodesk about the status of the vulnerability report sent on October 20th, 2009.: Core sends draft advisory and steps to reproduce the issue.: Autodesk acknowledges the report and requests the information to be provided in encrypted form.Core requests an acknoledgement within two working days and asks whehter the details should be sent encrypted or in plaintext. : Core notifies Autodesk of the vulnerabilty report and announces its initial plan to publish the content on November 2nd, 2009.: CERT sends their available contact information for Autodesk.: Core contacts CERT to obtain security contact information for Autodesk.: Core asks the Autodesk Assistance Team for a security contact to report the vulnerability.: Core Security Technologies ask the Autodesk Assistance Team for a security contact to report the vulnerability.Open Max, press F11 (MaxScript Listener), and paste this code: callbacks.addScript #filePostOpen ("DOSCommand(\"calc.exe\")") id:#mbLoadCallback persistent:true max file with MaxScript application callbacks embedded.Ī Proof of Concept file can be obtained by following these simple steps.
#Autodesk 3ds max logo code
Max allows users to bind MaxScript to application callbacks in a way that could be exploited by an attacker to execute arbitrary code by enticing a victim to open. Technical Description / Proof of Concept CodeĪutodesk 3D Studio Max provides built-in scripting language called MaxScript, which can be used to automate repetitive tasks, combine existing functionality in new ways, develop new tools and user interfaces and much more. The publication of this advisory was coordinated by Fernando Russ from Core Security Advisories Team. This vulnerability was discovered and researched by Sebastián Tello from Core Security Technologies during Bugweek 2009.
#Autodesk 3ds max logo software
The software provides a built-in scripting language, allowing users to bind custome code to actions performed in the applciation. Vulnerability InformationĬlass: Failure to Sanitize Data into a Different Plane Īutodesk 3D Studio Max is a modeling, animation and redering package widely used for video game, film, multimedia and web content developement. Title: Autodesk 3DS Max Application Callbacks Arbitrary Command Execution Autodesk 3DS Max Application Callbacks Arbitrary Command Execution 1.
0 kommentar(er)
