Blender '.blend' file Remote Command Execution Vulnerability
BID:36838
Info
Blender '.blend' file Remote Command Execution Vulnerability
| Bugtraq ID: | 36838 |
| Class: | Input Validation Error |
| CVE: |
CVE-2009-3850 |
| Remote: | Yes |
| Local: | No |
| Published: | Nov 05 2009 12:00AM |
| Updated: | May 07 2015 05:15PM |
| Credit: | Diego Juarez and Sebastian Tello from Core Security Technologies |
| Vulnerable: |
Gentoo Linux Blender Blender 2.49b Blender Blender 2.40 Blender Blender 2.35a Blender Blender 2.34 |
| Not Vulnerable: | |
Discussion
Blender '.blend' file Remote Command Execution Vulnerability
Blender is prone to a remote command-execution vulnerability.
Attackers may leverage this issue to execute arbitrary commands within the context of the application. Failed attacks will cause denial-of-service conditions.
Blender is prone to a remote command-execution vulnerability.
Attackers may leverage this issue to execute arbitrary commands within the context of the application. Failed attacks will cause denial-of-service conditions.
Exploit / POC
Blender '.blend' file Remote Command Execution Vulnerability
An attacker can exploit this issue by enticing an unsuspecting victim to open a specially crafted '.blend' file.
The following proof of concept demonstrates this issue:
. Open the "Text Editor" Panel.
. Right click on the canvas and select "New".
. Write your python code there. For instance:
/-----
import os
os.system("calc.exe")
-----/
. In the text name field (TX:Text.001) input a name for your
script, e.g.: TX:myscript.
. Open the "Buttons Window" panel.
. From the "panel" dropdown choose "Script".
. Check that "enable script links" is active.
. Click on "new".
. Select the script you created (e.g. myscript).
. Choose "OnLoad" from the event dropdown list.
. In the "User Preferences" panel, select File->Save, and save your project.
NOTE: Core Security Technologies has developed a working commercial exploit for its CORE IMPACT product. This exploit is not otherwise publicly available or known to be circulating in the wild.
An attacker can exploit this issue by enticing an unsuspecting victim to open a specially crafted '.blend' file.
The following proof of concept demonstrates this issue:
. Open the "Text Editor" Panel.
. Right click on the canvas and select "New".
. Write your python code there. For instance:
/-----
import os
os.system("calc.exe")
-----/
. In the text name field (TX:Text.001) input a name for your
script, e.g.: TX:myscript.
. Open the "Buttons Window" panel.
. From the "panel" dropdown choose "Script".
. Check that "enable script links" is active.
. Click on "new".
. Select the script you created (e.g. myscript).
. Choose "OnLoad" from the event dropdown list.
. In the "User Preferences" panel, select File->Save, and save your project.
NOTE: Core Security Technologies has developed a working commercial exploit for its CORE IMPACT product. This exploit is not otherwise publicly available or known to be circulating in the wild.
Solution / Fix
Blender '.blend' file Remote Command Execution Vulnerability
Solution:
Updates are available. Please see the references for more information.
Solution:
Updates are available. Please see the references for more information.
References
Blender '.blend' file Remote Command Execution Vulnerability
References:
References:
- Blender .blend Project Arbitrary Command Execution (Core Security Technologies)
- Blender Homepage (Blender)
- CORE-2009-0912: Blender .blend Project Arbitrary Command Execution (CORE Security Technologies Advisories