CVE-2008-4472
Vulnerability from cvelistv5
Published
2008-10-07 18:27
Modified
2024-08-07 10:17
Severity ?
Summary
The UpdateEngine class in the LiveUpdate ActiveX control (LiveUpdate16.DLL 17.2.56), as used in Revit Architecture 2009 SP2 and Autodesk Design Review 2009, allows remote attackers to execute arbitrary programs via the second argument to the ApplyPatch method.
References
cve@mitre.orghttp://images.autodesk.com/adsk/files/live_update_hotfix0.html
cve@mitre.orghttp://retrogod.altervista.org/9sg_autodesk_revit_arch_2009_exploit.html
cve@mitre.orghttp://securityreason.com/securityalert/4361
cve@mitre.orghttp://usa.autodesk.com/adsk/servlet/ps/dl/item?siteID=123112&id=12452198&linkID=11705366
cve@mitre.orghttp://www.securityfocus.com/archive/1/496847/100/0/threaded
cve@mitre.orghttp://www.securityfocus.com/bid/31490
cve@mitre.orghttp://www.vupen.com/english/advisories/2008/2704
cve@mitre.orghttps://exchange.xforce.ibmcloud.com/vulnerabilities/45521
cve@mitre.orghttps://www.exploit-db.com/exploits/6630
af854a3a-2127-422b-91ae-364da2661108http://images.autodesk.com/adsk/files/live_update_hotfix0.html
af854a3a-2127-422b-91ae-364da2661108http://retrogod.altervista.org/9sg_autodesk_revit_arch_2009_exploit.html
af854a3a-2127-422b-91ae-364da2661108http://securityreason.com/securityalert/4361
af854a3a-2127-422b-91ae-364da2661108http://usa.autodesk.com/adsk/servlet/ps/dl/item?siteID=123112&id=12452198&linkID=11705366
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/archive/1/496847/100/0/threaded
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/31490
af854a3a-2127-422b-91ae-364da2661108http://www.vupen.com/english/advisories/2008/2704
af854a3a-2127-422b-91ae-364da2661108https://exchange.xforce.ibmcloud.com/vulnerabilities/45521
af854a3a-2127-422b-91ae-364da2661108https://www.exploit-db.com/exploits/6630
Impacted products
Vendor Product Version
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T10:17:09.987Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "designreview-liveupdate-unauth-access(45521)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/45521"
          },
          {
            "name": "31490",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/31490"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://usa.autodesk.com/adsk/servlet/ps/dl/item?siteID=123112\u0026id=12452198\u0026linkID=11705366"
          },
          {
            "name": "6630",
            "tags": [
              "exploit",
              "x_refsource_EXPLOIT-DB",
              "x_transferred"
            ],
            "url": "https://www.exploit-db.com/exploits/6630"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://images.autodesk.com/adsk/files/live_update_hotfix0.html"
          },
          {
            "name": "4361",
            "tags": [
              "third-party-advisory",
              "x_refsource_SREASON",
              "x_transferred"
            ],
            "url": "http://securityreason.com/securityalert/4361"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://retrogod.altervista.org/9sg_autodesk_revit_arch_2009_exploit.html"
          },
          {
            "name": "ADV-2008-2704",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2008/2704"
          },
          {
            "name": "20080930 Autodesk DWF Viewer Control / LiveUpdate Module remote code execution exploit",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/496847/100/0/threaded"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2008-09-30T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "The UpdateEngine class in the LiveUpdate ActiveX control (LiveUpdate16.DLL 17.2.56), as used in Revit Architecture 2009 SP2 and Autodesk Design Review 2009, allows remote attackers to execute arbitrary programs via the second argument to the ApplyPatch method."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-11T19:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "designreview-liveupdate-unauth-access(45521)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/45521"
        },
        {
          "name": "31490",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/31490"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://usa.autodesk.com/adsk/servlet/ps/dl/item?siteID=123112\u0026id=12452198\u0026linkID=11705366"
        },
        {
          "name": "6630",
          "tags": [
            "exploit",
            "x_refsource_EXPLOIT-DB"
          ],
          "url": "https://www.exploit-db.com/exploits/6630"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://images.autodesk.com/adsk/files/live_update_hotfix0.html"
        },
        {
          "name": "4361",
          "tags": [
            "third-party-advisory",
            "x_refsource_SREASON"
          ],
          "url": "http://securityreason.com/securityalert/4361"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://retrogod.altervista.org/9sg_autodesk_revit_arch_2009_exploit.html"
        },
        {
          "name": "ADV-2008-2704",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2008/2704"
        },
        {
          "name": "20080930 Autodesk DWF Viewer Control / LiveUpdate Module remote code execution exploit",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/496847/100/0/threaded"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2008-4472",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The UpdateEngine class in the LiveUpdate ActiveX control (LiveUpdate16.DLL 17.2.56), as used in Revit Architecture 2009 SP2 and Autodesk Design Review 2009, allows remote attackers to execute arbitrary programs via the second argument to the ApplyPatch method."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "designreview-liveupdate-unauth-access(45521)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/45521"
            },
            {
              "name": "31490",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/31490"
            },
            {
              "name": "http://usa.autodesk.com/adsk/servlet/ps/dl/item?siteID=123112\u0026id=12452198\u0026linkID=11705366",
              "refsource": "MISC",
              "url": "http://usa.autodesk.com/adsk/servlet/ps/dl/item?siteID=123112\u0026id=12452198\u0026linkID=11705366"
            },
            {
              "name": "6630",
              "refsource": "EXPLOIT-DB",
              "url": "https://www.exploit-db.com/exploits/6630"
            },
            {
              "name": "http://images.autodesk.com/adsk/files/live_update_hotfix0.html",
              "refsource": "MISC",
              "url": "http://images.autodesk.com/adsk/files/live_update_hotfix0.html"
            },
            {
              "name": "4361",
              "refsource": "SREASON",
              "url": "http://securityreason.com/securityalert/4361"
            },
            {
              "name": "http://retrogod.altervista.org/9sg_autodesk_revit_arch_2009_exploit.html",
              "refsource": "MISC",
              "url": "http://retrogod.altervista.org/9sg_autodesk_revit_arch_2009_exploit.html"
            },
            {
              "name": "ADV-2008-2704",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2008/2704"
            },
            {
              "name": "20080930 Autodesk DWF Viewer Control / LiveUpdate Module remote code execution exploit",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/496847/100/0/threaded"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2008-4472",
    "datePublished": "2008-10-07T18:27:00",
    "dateReserved": "2008-10-07T00:00:00",
    "dateUpdated": "2024-08-07T10:17:09.987Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:autodesk:design_review:2009:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"D015F7C3-BBFB-418C-8B50-2047AE1E142E\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:autodesk:dwf_viewer:*:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"9E11496F-A4A3-48B2-BFD4-D00D13BD9E2B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:autodesk:revit_architecture:2009:sp2:*:*:*:*:*:*\", \"matchCriteriaId\": \"877A0489-AC5E-4A8C-827B-EDD6EF62E0BD\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"The UpdateEngine class in the LiveUpdate ActiveX control (LiveUpdate16.DLL 17.2.56), as used in Revit Architecture 2009 SP2 and Autodesk Design Review 2009, allows remote attackers to execute arbitrary programs via the second argument to the ApplyPatch method.\"}, {\"lang\": \"es\", \"value\": \"La clase UpdateEngine en el control Active X LiveUpdate (LiveUpdate16.DLL 17.2.56), utilizado en Revit Architecture 2009 SP2 y Autodesk Design Review 2009, que permite a los atacantes remotos ejecutar arbitrariamente programas a trav\\u00e9s del segundo argumento del m\\u00e9todo ApplyPatch.\"}]",
      "id": "CVE-2008-4472",
      "lastModified": "2024-11-21T00:51:45.630",
      "metrics": "{\"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:N/AC:M/Au:N/C:C/I:C/A:C\", \"baseScore\": 9.3, \"accessVector\": \"NETWORK\", \"accessComplexity\": \"MEDIUM\", \"authentication\": \"NONE\", \"confidentialityImpact\": \"COMPLETE\", \"integrityImpact\": \"COMPLETE\", \"availabilityImpact\": \"COMPLETE\"}, \"baseSeverity\": \"HIGH\", \"exploitabilityScore\": 8.6, \"impactScore\": 10.0, \"acInsufInfo\": false, \"obtainAllPrivilege\": true, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": true}]}",
      "published": "2008-10-07T20:00:17.420",
      "references": "[{\"url\": \"http://images.autodesk.com/adsk/files/live_update_hotfix0.html\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://retrogod.altervista.org/9sg_autodesk_revit_arch_2009_exploit.html\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://securityreason.com/securityalert/4361\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://usa.autodesk.com/adsk/servlet/ps/dl/item?siteID=123112\u0026id=12452198\u0026linkID=11705366\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://www.securityfocus.com/archive/1/496847/100/0/threaded\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://www.securityfocus.com/bid/31490\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://www.vupen.com/english/advisories/2008/2704\", \"source\": \"cve@mitre.org\"}, {\"url\": \"https://exchange.xforce.ibmcloud.com/vulnerabilities/45521\", \"source\": \"cve@mitre.org\"}, {\"url\": \"https://www.exploit-db.com/exploits/6630\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://images.autodesk.com/adsk/files/live_update_hotfix0.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://retrogod.altervista.org/9sg_autodesk_revit_arch_2009_exploit.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://securityreason.com/securityalert/4361\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://usa.autodesk.com/adsk/servlet/ps/dl/item?siteID=123112\u0026id=12452198\u0026linkID=11705366\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://www.securityfocus.com/archive/1/496847/100/0/threaded\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://www.securityfocus.com/bid/31490\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://www.vupen.com/english/advisories/2008/2704\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://exchange.xforce.ibmcloud.com/vulnerabilities/45521\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://www.exploit-db.com/exploits/6630\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "cve@mitre.org",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-264\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2008-4472\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2008-10-07T20:00:17.420\",\"lastModified\":\"2024-11-21T00:51:45.630\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"The UpdateEngine class in the LiveUpdate ActiveX control (LiveUpdate16.DLL 17.2.56), as used in Revit Architecture 2009 SP2 and Autodesk Design Review 2009, allows remote attackers to execute arbitrary programs via the second argument to the ApplyPatch method.\"},{\"lang\":\"es\",\"value\":\"La clase UpdateEngine en el control Active X LiveUpdate (LiveUpdate16.DLL 17.2.56), utilizado en Revit Architecture 2009 SP2 y Autodesk Design Review 2009, que permite a los atacantes remotos ejecutar arbitrariamente programas a trav\u00e9s del segundo argumento del m\u00e9todo ApplyPatch.\"}],\"metrics\":{\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:M/Au:N/C:C/I:C/A:C\",\"baseScore\":9.3,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"COMPLETE\",\"integrityImpact\":\"COMPLETE\",\"availabilityImpact\":\"COMPLETE\"},\"baseSeverity\":\"HIGH\",\"exploitabilityScore\":8.6,\"impactScore\":10.0,\"acInsufInfo\":false,\"obtainAllPrivilege\":true,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":true}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-264\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:autodesk:design_review:2009:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D015F7C3-BBFB-418C-8B50-2047AE1E142E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:autodesk:dwf_viewer:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9E11496F-A4A3-48B2-BFD4-D00D13BD9E2B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:autodesk:revit_architecture:2009:sp2:*:*:*:*:*:*\",\"matchCriteriaId\":\"877A0489-AC5E-4A8C-827B-EDD6EF62E0BD\"}]}]}],\"references\":[{\"url\":\"http://images.autodesk.com/adsk/files/live_update_hotfix0.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://retrogod.altervista.org/9sg_autodesk_revit_arch_2009_exploit.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://securityreason.com/securityalert/4361\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://usa.autodesk.com/adsk/servlet/ps/dl/item?siteID=123112\u0026id=12452198\u0026linkID=11705366\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.securityfocus.com/archive/1/496847/100/0/threaded\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.securityfocus.com/bid/31490\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.vupen.com/english/advisories/2008/2704\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://exchange.xforce.ibmcloud.com/vulnerabilities/45521\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://www.exploit-db.com/exploits/6630\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://images.autodesk.com/adsk/files/live_update_hotfix0.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://retrogod.altervista.org/9sg_autodesk_revit_arch_2009_exploit.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://securityreason.com/securityalert/4361\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://usa.autodesk.com/adsk/servlet/ps/dl/item?siteID=123112\u0026id=12452198\u0026linkID=11705366\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.securityfocus.com/archive/1/496847/100/0/threaded\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.securityfocus.com/bid/31490\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.vupen.com/english/advisories/2008/2704\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://exchange.xforce.ibmcloud.com/vulnerabilities/45521\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://www.exploit-db.com/exploits/6630\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.