CVE-2008-4472 - Vulnerability Details - OpenCVE

Description

The UpdateEngine class in the LiveUpdate ActiveX control (LiveUpdate16.DLL 17.2.56), as used in Revit Architecture 2009 SP2 and Autodesk Design Review 2009, allows remote attackers to execute arbitrary programs via the second argument to the ApplyPatch method.

Published: 2008-10-07

Score: 9.3 Critical

EPSS: 11.3% Moderate

KEV: No

Impact:

Action:

Analysis

No analysis available yet.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

n/a

n/a

affected

Version	Status	Constraints
`n/a`	affected	—

Configuration 1 [-]

OR	cpe:2.3:a:autodesk:design_review:2009:::::::*
	cpe:2.3:a:autodesk:dwf_viewer::::::::
	cpe:2.3:a:autodesk:revit_architecture:2009:sp2::::::

No data.

No data available yet.

Remediation

No remediation available yet.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact Complete

Integrity Impact Complete

Availability Impact Complete

This CVE is not in the KEV list.

The EPSS score is 0.11319.

Key SSVC decision points have not yet been added.

References

Link	Providers
http://images.autodesk.com/adsk/files/live_update_hotfix0.html
http://retrogod.altervista.org/9sg_autodesk_revit_arch_2009_exploit.html
http://securityreason.com/securityalert/4361
http://usa.autodesk.com/adsk/servlet/ps/dl/item?siteID=123112&id=12452198&linkID=11705366
http://www.securityfocus.com/archive/1/496847/100/0/threaded
http://www.securityfocus.com/bid/31490
http://www.vupen.com/english/advisories/2008/2704
https://exchange.xforce.ibmcloud.com/vulnerabilities/45521
https://www.exploit-db.com/exploits/6630

History

No history.

Subscriptions

Autodesk Design Review Dwf Viewer Revit Architecture

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2008-10-07T18:27:00.000Z

Updated: 2024-08-07T10:17:09.987Z

Reserved: 2008-10-07T00:00:00.000Z

Link: CVE-2008-4472

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2008-10-07T20:00:17.420

Modified: 2025-04-09T00:30:58.490

Link: CVE-2008-4472

Redhat

No data.

OpenCVE Enrichment

No data.

Weaknesses

CWE-264

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2008-09-30T00:00:00.000Z", "descriptions": [{"lang": "en", "value": "The UpdateEngine class in the LiveUpdate ActiveX control (LiveUpdate16.DLL 17.2.56), as used in Revit Architecture 2009 SP2 and Autodesk Design Review 2009, allows remote attackers to execute arbitrary programs via the second argument to the ApplyPatch method."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-10-11T19:57:01.000Z", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "designreview-liveupdate-unauth-access(45521)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/45521"}, {"name": "31490", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/31490"}, {"tags": ["x_refsource_MISC"], "url": "http://usa.autodesk.com/adsk/servlet/ps/dl/item?siteID=123112&id=12452198&linkID=11705366"}, {"name": "6630", "tags": ["exploit", "x_refsource_EXPLOIT-DB"], "url": "https://www.exploit-db.com/exploits/6630"}, {"tags": ["x_refsource_MISC"], "url": "http://images.autodesk.com/adsk/files/live_update_hotfix0.html"}, {"name": "4361", "tags": ["third-party-advisory", "x_refsource_SREASON"], "url": "http://securityreason.com/securityalert/4361"}, {"tags": ["x_refsource_MISC"], "url": "http://retrogod.altervista.org/9sg_autodesk_revit_arch_2009_exploit.html"}, {"name": "ADV-2008-2704", "tags": ["vdb-entry", "x_refsource_VUPEN"], "url": "http://www.vupen.com/english/advisories/2008/2704"}, {"name": "20080930 Autodesk DWF Viewer Control / LiveUpdate Module remote code execution exploit", "tags": ["mailing-list", "x_refsource_BUGTRAQ"], "url": "http://www.securityfocus.com/archive/1/496847/100/0/threaded"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2008-4472", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "The UpdateEngine class in the LiveUpdate ActiveX control (LiveUpdate16.DLL 17.2.56), as used in Revit Architecture 2009 SP2 and Autodesk Design Review 2009, allows remote attackers to execute arbitrary programs via the second argument to the ApplyPatch method."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "designreview-liveupdate-unauth-access(45521)", "refsource": "XF", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/45521"}, {"name": "31490", "refsource": "BID", "url": "http://www.securityfocus.com/bid/31490"}, {"name": "http://usa.autodesk.com/adsk/servlet/ps/dl/item?siteID=123112&id=12452198&linkID=11705366", "refsource": "MISC", "url": "http://usa.autodesk.com/adsk/servlet/ps/dl/item?siteID=123112&id=12452198&linkID=11705366"}, {"name": "6630", "refsource": "EXPLOIT-DB", "url": "https://www.exploit-db.com/exploits/6630"}, {"name": "http://images.autodesk.com/adsk/files/live_update_hotfix0.html", "refsource": "MISC", "url": "http://images.autodesk.com/adsk/files/live_update_hotfix0.html"}, {"name": "4361", "refsource": "SREASON", "url": "http://securityreason.com/securityalert/4361"}, {"name": "http://retrogod.altervista.org/9sg_autodesk_revit_arch_2009_exploit.html", "refsource": "MISC", "url": "http://retrogod.altervista.org/9sg_autodesk_revit_arch_2009_exploit.html"}, {"name": "ADV-2008-2704", "refsource": "VUPEN", "url": "http://www.vupen.com/english/advisories/2008/2704"}, {"name": "20080930 Autodesk DWF Viewer Control / LiveUpdate Module remote code execution exploit", "refsource": "BUGTRAQ", "url": "http://www.securityfocus.com/archive/1/496847/100/0/threaded"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-07T10:17:09.987Z"}, "title": "CVE Program Container", "references": [{"name": "designreview-liveupdate-unauth-access(45521)", "tags": ["vdb-entry", "x_refsource_XF", "x_transferred"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/45521"}, {"name": "31490", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/31490"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://usa.autodesk.com/adsk/servlet/ps/dl/item?siteID=123112&id=12452198&linkID=11705366"}, {"name": "6630", "tags": ["exploit", "x_refsource_EXPLOIT-DB", "x_transferred"], "url": "https://www.exploit-db.com/exploits/6630"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://images.autodesk.com/adsk/files/live_update_hotfix0.html"}, {"name": "4361", "tags": ["third-party-advisory", "x_refsource_SREASON", "x_transferred"], "url": "http://securityreason.com/securityalert/4361"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://retrogod.altervista.org/9sg_autodesk_revit_arch_2009_exploit.html"}, {"name": "ADV-2008-2704", "tags": ["vdb-entry", "x_refsource_VUPEN", "x_transferred"], "url": "http://www.vupen.com/english/advisories/2008/2704"}, {"name": "20080930 Autodesk DWF Viewer Control / LiveUpdate Module remote code execution exploit", "tags": ["mailing-list", "x_refsource_BUGTRAQ", "x_transferred"], "url": "http://www.securityfocus.com/archive/1/496847/100/0/threaded"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2008-4472", "datePublished": "2008-10-07T18:27:00.000Z", "dateReserved": "2008-10-07T00:00:00.000Z", "dateUpdated": "2024-08-07T10:17:09.987Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:autodesk:design_review:2009:*:*:*:*:*:*:*", "matchCriteriaId": "D015F7C3-BBFB-418C-8B50-2047AE1E142E", "vulnerable": true}, {"criteria": "cpe:2.3:a:autodesk:dwf_viewer:*:*:*:*:*:*:*:*", "matchCriteriaId": "9E11496F-A4A3-48B2-BFD4-D00D13BD9E2B", "vulnerable": true}, {"criteria": "cpe:2.3:a:autodesk:revit_architecture:2009:sp2:*:*:*:*:*:*", "matchCriteriaId": "877A0489-AC5E-4A8C-827B-EDD6EF62E0BD", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The UpdateEngine class in the LiveUpdate ActiveX control (LiveUpdate16.DLL 17.2.56), as used in Revit Architecture 2009 SP2 and Autodesk Design Review 2009, allows remote attackers to execute arbitrary programs via the second argument to the ApplyPatch method."}, {"lang": "es", "value": "La clase UpdateEngine en el control Active X LiveUpdate (LiveUpdate16.DLL 17.2.56), utilizado en Revit Architecture 2009 SP2 y Autodesk Design Review 2009, que permite a los atacantes remotos ejecutar arbitrariamente programas a trav\u00e9s del segundo argumento del m\u00e9todo ApplyPatch."}], "id": "CVE-2008-4472", "lastModified": "2025-04-09T00:30:58.490", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 9.3, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 10.0, "obtainAllPrivilege": true, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}]}, "published": "2008-10-07T20:00:17.420", "references": [{"source": "cve@mitre.org", "url": "http://images.autodesk.com/adsk/files/live_update_hotfix0.html"}, {"source": "cve@mitre.org", "url": "http://retrogod.altervista.org/9sg_autodesk_revit_arch_2009_exploit.html"}, {"source": "cve@mitre.org", "url": "http://securityreason.com/securityalert/4361"}, {"source": "cve@mitre.org", "url": "http://usa.autodesk.com/adsk/servlet/ps/dl/item?siteID=123112&id=12452198&linkID=11705366"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/archive/1/496847/100/0/threaded"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/bid/31490"}, {"source": "cve@mitre.org", "url": "http://www.vupen.com/english/advisories/2008/2704"}, {"source": "cve@mitre.org", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/45521"}, {"source": "cve@mitre.org", "url": "https://www.exploit-db.com/exploits/6630"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://images.autodesk.com/adsk/files/live_update_hotfix0.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://retrogod.altervista.org/9sg_autodesk_revit_arch_2009_exploit.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://securityreason.com/securityalert/4361"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://usa.autodesk.com/adsk/servlet/ps/dl/item?siteID=123112&id=12452198&linkID=11705366"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/archive/1/496847/100/0/threaded"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/bid/31490"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.vupen.com/english/advisories/2008/2704"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/45521"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://www.exploit-db.com/exploits/6630"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-264"}], "source": "nvd@nist.gov", "type": "Primary"}]}