This host is installed with blender and is prone to Remote Command Execution Vulnerability.

Successful exploitation will allow attackers to execute arbitrary commands by sending a specially crafted .blend file that contains Python statements in the onLoad action of a ScriptLink SDNA. Impact Level: Application

No solution or patch was made available for at least one year since disclosure of this vulnerability. Likely none will be provided anymore. General solution options are to upgrade to a newer release, disable respective features, remove the product or replace the product by another one.

This flaw is generated because Blender allows .blend project files to be modified to execute arbitrary commands without user intervention by design.

Blender 2.49b, 2.40, 2.35a, 2.34 and prior.

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3850
• http://www.coresecurity.com/content/blender-scripting-injection

---

Updated on 2015-03-25