-----BEGIN PGP SIGNED MESSAGE-----
Autodesk IDrop ActiveX Control
The Src, Background, PackageXml properties can be manipulated to
trigger a heap use after free condition resulting in arbitrary
remote code execution. Other properties may be vulnerable as well.
Remove or set the killbit for the affected control, see
Currently, there will be NO official patch for this issue.
Autodesk's statement is as follows:
"Thank you for taking the time and effort to identify a potential
issue with our technology. We do take each and every customer or
developer issue seriously and have spent time in reviewing your
analysis of our i-drop technology. At this time, we have ceased
investment in i-drop technology. It was released over five years
ago as a means for developers to leverage their content delivery;
we’ve made no new investment in this tool and have no current plans
to update it in the near future. We’ve recorded your issue in our
tracking database and will determine its priority if/when we
determine new investment is required for this technology.
Thank You – Autodesk"
06/17/2008 - Vendor notified
03/31/2009 - Vendor final response
04/02/2009 - this advisory
-----BEGIN PGP SIGNATURE-----
Version: Hush 3.0
Note: This signature can be verified at https://www.hushtools.com/verify
-----END PGP SIGNATURE-----
Top brands, low prices. Find the right air conditioner for you. Click Now!