Subject: SYMSA-2007-008: Autodesk Backburner 3.0.2 System BackdoorĪdvisory Title: Autodesk Backburner 3.0.2 : System BackdoorĪuthor: Dave Hartley and Stephen Date: 12-09-2007 (Vendor Issues Fix) Autodesk Backburner cmdjob Utility Lets Remote Users Execute Arbitrary Commands This archive entry has one or more follow-up message(s) listed below. The vendor notes and the documentation states that the affected cmdjob function is intended for use only on closed networks.Īs a workaround, the cmdjob utility can be removed. No solution was available at the time of this entry. The vulnerable component is used in the following Autodesk products:ģds Max, Combustion, Inferno, Flame, Flint, Fire, Smoke, and Lustre.Ī remote user can execute arbitrary commands on the target system with administrative privileges. The commands will run with the privileges of the target service, which are typically administrative privileges.ĭave Hartley and Stephen Kapp of Symantec reported this vulnerability. A remote user can execute arbitrary commands on the target system.īy design and function, a remote user can send commands to the cmdjob utility on TCP port 3234 on the target system to execute arbitrary operating system commands. Impact: Execution of arbitrary code via network, Root access via network, User access via networkĪ vulnerability was reported in Autodesk Backburner, used in several Autodesk products. Home | View Topics | Search | Contact Us |Īutodesk Backburner cmdjob Utility Lets Remote Users Execute Arbitrary CommandsĬVE Reference: CVE-2007-4749 (Links to External Site) Autodesk Backburner cmdjob Utility Lets Remote Users Execute Arbitrary Commands - SecurityTracker

Backburner software