Technology has evolved in incredible ways that has helped people to create and visualize media like never before. Today, people can use tools such as Blender to visualize, model, and animate 3D content, especially since it's free and open-source software. However, this also make it an attractive target for adversaries to audit and find vulnerabilities. Given the user base of Blender, exploiting these vulnerabilities to compromise a user could have a significant impact as attackers could use the foothold gained by attacking Blender to further compromise an organization's network.
Today, Talos is disclosing multiple vulnerabilities that have been identified in Blender. These vulnerabilities could allow an attacker to execute arbitrary code on an affected host running Blender. A user who opens a specially crafted file in Blender that is designed to trigger one of these vulnerabilities could be exploited and compromised.
Talos has responsibly disclosed these vulnerabilities to Blender in an attempt to ensure they are addressed. However, Blender has declined to address them stating that 'fixing these issues one by one is also a waste of time.' As a result, there currently is no software update that addresses these vulnerabilities. Additionally, Blender developers believe that 'opening a file with Blender should be considered like opening a file with the Python interpreter, you have [to trust] the source it is coming from.'
[Attachment]
Read More »
Cisco Systems Inc. published this content on 11 January 2018 and is solely responsible for the information contained herein. Distributed by Public, unedited and unaltered, on 11 January 2018 15:24:08 UTC.
Original documenthttps://blogs.cisco.com/security/talos/vulnerability-spotlight-multiple-unpatched-vulnerabilities-in-blender-identified
Public permalinkhttp://www.publicnow.com/view/109512298D585AEDAC65652C92E63270BC2E4D3B
Cisco Systems, Inc. is the world leader in designing, developing, and marketing Internet network equipment. Net sales break down by family of products and services as follows:
- network equipment (68.9%); switches and routers, technological software and systems (storage, Internet access, and security systems, wiring, gateways, connection interfaces and modules, etc.), etc.;
- services (24.3%): technical assistance, network design, execution, and integration services, etc.;
- security products (6.8%).
Net sales are distributed geographically as follows: Americas (58.7%), Europe/Middle East/Africa (26.6%) and Asia/Pacific (14.7%).
CISCO SYSTEMS, INC. 
