CVE-2009-1792

Related Files

Core Security Technologies Advisory 2009.0401

Posted May 29, 2009

Authored by Core Security Technologies | Site coresecurity.com

Core Security Technologies Advisory - Ston3D StandalonePlayer and WebPlayer are vulnerable to a command injection vulnerability, which can be exploited by malicious remote attackers. The vulnerability is due to the Ston3D scripting language. It provides the function 'system.openURL()' which does not properly sanitize the input before using it. This can be exploited to execute arbitrary commands with the privileges of the Stone3D player by opening a specially crafted file.

tags | advisory, remote, arbitrary

advisories | CVE-2009-1792

SHA-256 | ba901a044dfa0737878b1901f13a67a16f2cb60751e063e166d74890420fe9f5

Download | Favorite | View