Unscored severity · published Oct 7, 2008
CVE-2008-4472
The UpdateEngine class in the LiveUpdate ActiveX control (LiveUpdate16.DLL 17.2.56), as used in Revit Architecture 2009 SP2 and Autodesk Design Review 2009, allows remote…
–
CVSS
7.8%
EPSS
No
On KEV
Description
The UpdateEngine class in the LiveUpdate ActiveX control (LiveUpdate16.DLL 17.2.56), as used in Revit Architecture 2009 SP2 and Autodesk Design Review 2009, allows remote attackers to execute arbitrary programs via the second argument to the ApplyPatch method.
Exploitation
Is it being used?
Exploit prediction (EPSS)7.8% · higher than 95% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DR
Design Review · Autodesk
2009 · source: NVD
DV
Dwf Viewer · Autodesk
All versions, or not specified · source: NVD
RA
Revit Architecture · Autodesk
2009 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2008-4472
CVE.org
https://www.cve.org/CVERecord?id=CVE-2008-4472
images.autodesk.com
http://images.autodesk.com/adsk/files/live_update_hotfix0.html
retrogod.altervista.org
http://retrogod.altervista.org/9sg_autodesk_revit_arch_2009_exploit.html
securityreason.com
http://securityreason.com/securityalert/4361
usa.autodesk.com
http://usa.autodesk.com/adsk/servlet/ps/dl/item?siteID=123112&id=12452198&linkID=11705366
www.securityfocus.com
http://www.securityfocus.com/archive/1/496847/100/0/threaded
www.securityfocus.com
http://www.securityfocus.com/bid/31490
More from Design Review
8.8
CVE-2022-27864
A Double Free vulnerability allows remote attackers to execute arbitrary code through DesignReview.exe application on PDF files within affected installations
8.1
CVE-2021-27033
A maliciously crafted PDF file, when opened by a user in Autodesk Design Review, can trigger a Double Free vulnerability in the Autodesk Design Review application
7.8
CVE-2022-42943
A malicious crafted dwf or .pct file when consumed through DesignReview.exe application could lead to memory corruption vulnerability by read access violation
7.8
CVE-2022-42942
A malicious crafted dwf or .pct file when consumed through DesignReview.exe application could lead to memory corruption vulnerability by read access violation
7.8
CVE-2022-42941
A malicious crafted dwf or .pct file when consumed through DesignReview.exe application could lead to memory corruption vulnerability by read access violation