CVE-2008-4472
Autodesk DWF Viewer Control / LiveUpdate Module - Remote Code Execution
Severity Score
9.3
*CVSS v2
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
1
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
The UpdateEngine class in the LiveUpdate ActiveX control (LiveUpdate16.DLL 17.2.56), as used in Revit Architecture 2009 SP2 and Autodesk Design Review 2009, allows remote attackers to execute arbitrary programs via the second argument to the ApplyPatch method.
La clase UpdateEngine en el control Active X LiveUpdate (LiveUpdate16.DLL 17.2.56), utilizado en Revit Architecture 2009 SP2 y Autodesk Design Review 2009, que permite a los atacantes remotos ejecutar arbitrariamente programas a través del segundo argumento del método ApplyPatch.
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2008-10-07 CVE Reserved
- 2008-10-07 CVE Published
- 2024-08-07 CVE Updated
- 2024-08-07 First Exploit
- 2024-10-13 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-264: Permissions, Privileges, and Access Controls
CAPEC
References (9)
| URL | Tag | Source |
|---|---|---|
| http://images.autodesk.com/adsk/files/live_update_hotfix0.html | X_refsource_misc | |
| http://retrogod.altervista.org/9sg_autodesk_revit_arch_2009_exploit.html | X_refsource_misc | |
| http://securityreason.com/securityalert/4361 | Third Party Advisory | |
| http://usa.autodesk.com/adsk/servlet/ps/dl/item?siteID=123112&id=12452198&linkID=11705366 | X_refsource_misc | |
| http://www.securityfocus.com/archive/1/496847/100/0/threaded | Mailing List | |
| http://www.securityfocus.com/bid/31490 | Vdb Entry | |
| http://www.vupen.com/english/advisories/2008/2704 | Vdb Entry | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/45521 | Vdb Entry |
| URL | Date | SRC |
|---|---|---|
| https://www.exploit-db.com/exploits/6630 | 2024-08-07 |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Autodesk Search vendor "Autodesk" | Design Review Search vendor "Autodesk" for product "Design Review" | 2009 Search vendor "Autodesk" for product "Design Review" and version "2009" | - |
Affected
| ||||||
| Autodesk Search vendor "Autodesk" | Dwf Viewer Search vendor "Autodesk" for product "Dwf Viewer" | * | - |
Affected
| ||||||
| Autodesk Search vendor "Autodesk" | Revit Architecture Search vendor "Autodesk" for product "Revit Architecture" | 2009 Search vendor "Autodesk" for product "Revit Architecture" and version "2009" | sp2 |
Affected
| ||||||