fkie_cve-2008-4472
Vulnerability from fkie_nvd
Published
2008-10-07 20:00
Modified
2025-04-09 00:30
Severity ?
Summary
The UpdateEngine class in the LiveUpdate ActiveX control (LiveUpdate16.DLL 17.2.56), as used in Revit Architecture 2009 SP2 and Autodesk Design Review 2009, allows remote attackers to execute arbitrary programs via the second argument to the ApplyPatch method.
References
cve@mitre.orghttp://images.autodesk.com/adsk/files/live_update_hotfix0.html
cve@mitre.orghttp://retrogod.altervista.org/9sg_autodesk_revit_arch_2009_exploit.html
cve@mitre.orghttp://securityreason.com/securityalert/4361
cve@mitre.orghttp://usa.autodesk.com/adsk/servlet/ps/dl/item?siteID=123112&id=12452198&linkID=11705366
cve@mitre.orghttp://www.securityfocus.com/archive/1/496847/100/0/threaded
cve@mitre.orghttp://www.securityfocus.com/bid/31490
cve@mitre.orghttp://www.vupen.com/english/advisories/2008/2704
cve@mitre.orghttps://exchange.xforce.ibmcloud.com/vulnerabilities/45521
cve@mitre.orghttps://www.exploit-db.com/exploits/6630
af854a3a-2127-422b-91ae-364da2661108http://images.autodesk.com/adsk/files/live_update_hotfix0.html
af854a3a-2127-422b-91ae-364da2661108http://retrogod.altervista.org/9sg_autodesk_revit_arch_2009_exploit.html
af854a3a-2127-422b-91ae-364da2661108http://securityreason.com/securityalert/4361
af854a3a-2127-422b-91ae-364da2661108http://usa.autodesk.com/adsk/servlet/ps/dl/item?siteID=123112&id=12452198&linkID=11705366
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/archive/1/496847/100/0/threaded
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/31490
af854a3a-2127-422b-91ae-364da2661108http://www.vupen.com/english/advisories/2008/2704
af854a3a-2127-422b-91ae-364da2661108https://exchange.xforce.ibmcloud.com/vulnerabilities/45521
af854a3a-2127-422b-91ae-364da2661108https://www.exploit-db.com/exploits/6630
Impacted products
Vendor Product Version
autodesk design_review 2009
autodesk dwf_viewer *
autodesk revit_architecture 2009


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:autodesk:design_review:2009:*:*:*:*:*:*:*",
              "matchCriteriaId": "D015F7C3-BBFB-418C-8B50-2047AE1E142E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:autodesk:dwf_viewer:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "9E11496F-A4A3-48B2-BFD4-D00D13BD9E2B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:autodesk:revit_architecture:2009:sp2:*:*:*:*:*:*",
              "matchCriteriaId": "877A0489-AC5E-4A8C-827B-EDD6EF62E0BD",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The UpdateEngine class in the LiveUpdate ActiveX control (LiveUpdate16.DLL 17.2.56), as used in Revit Architecture 2009 SP2 and Autodesk Design Review 2009, allows remote attackers to execute arbitrary programs via the second argument to the ApplyPatch method."
    },
    {
      "lang": "es",
      "value": "La clase UpdateEngine en el control Active X LiveUpdate (LiveUpdate16.DLL 17.2.56), utilizado en Revit Architecture 2009 SP2 y Autodesk Design Review 2009, que permite a los atacantes remotos ejecutar arbitrariamente programas a trav\u00e9s del segundo argumento del m\u00e9todo ApplyPatch."
    }
  ],
  "id": "CVE-2008-4472",
  "lastModified": "2025-04-09T00:30:58.490",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "COMPLETE",
          "baseScore": 9.3,
          "confidentialityImpact": "COMPLETE",
          "integrityImpact": "COMPLETE",
          "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 10.0,
        "obtainAllPrivilege": true,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ]
  },
  "published": "2008-10-07T20:00:17.420",
  "references": [
    {
      "source": "cve@mitre.org",
      "url": "http://images.autodesk.com/adsk/files/live_update_hotfix0.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://retrogod.altervista.org/9sg_autodesk_revit_arch_2009_exploit.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://securityreason.com/securityalert/4361"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://usa.autodesk.com/adsk/servlet/ps/dl/item?siteID=123112\u0026id=12452198\u0026linkID=11705366"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/archive/1/496847/100/0/threaded"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/bid/31490"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.vupen.com/english/advisories/2008/2704"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/45521"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://www.exploit-db.com/exploits/6630"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://images.autodesk.com/adsk/files/live_update_hotfix0.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://retrogod.altervista.org/9sg_autodesk_revit_arch_2009_exploit.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://securityreason.com/securityalert/4361"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://usa.autodesk.com/adsk/servlet/ps/dl/item?siteID=123112\u0026id=12452198\u0026linkID=11705366"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/archive/1/496847/100/0/threaded"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/bid/31490"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.vupen.com/english/advisories/2008/2704"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/45521"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://www.exploit-db.com/exploits/6630"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-264"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.