BusinessObjects Enterprise and Crystal Reports Server denial of service
| business-object-crystal-server-dos (21654) |  Low Risk |
Description:
BusinessObjects Enterprise is vulnerable to a denial of service attack caused by an unspecified vulnerability in the crystalras.exe. A remote attacker could send a specially-crafted request to cause the system to lock, resulting in a denial of service.
Platforms Affected:
- BusinessObjects, Crystal Enterprise XI
- BusinessObjects, Crystal Reports XI
- HP, HP-UX 11
- IBM, AIX 5.1
- RedHat, Enterprise Linux 3
- Sun, Solaris 10
- Sun, Solaris 8
- Sun, Solaris 8.1
- Sun, Solaris 8.2
- Sun, Solaris 9
- Sun, Solaris 9.1
Remedy:
Apply the appropriate patch for your system, as listed in the Business Objects Security Bulletin. See References.
Consequences:
Denial of Service
References:
- BusinessObjects Enterprise Web page, BusinessObjects Enterprise at http://www.businessobjects.com/products/platform/enterprise.asp.
- BusinessObjects Security Bulletin, Vulnerability in Crystal Report Application Server could allow Denial of Service at http://support.businessobjects.com/fix/hot/critical/bulletins/security_bulletin_june05.asp.
- Crystal Reports Web page, Crystal Reports at http://www.businessobjects.com/products/reporting/crystalreports/default.asp.
- BID-14433: Business Objects Enterprise/Crystal Reports Server Unspecified Denial Of Service Vulnerability
- CVE-2005-4813: Unspecified vulnerability in Report Application Server (Crystalras.exe) before 11.0.0.1370, as used in Business Objects Crystal Reports XI, Crystal Reports Server XI, and BusinessObjects Enterprise XI, allows remote attackers to cause a denial of service (application hang) via certain network traffic, possibly involving multiple simultaneous TCP connections.
- OSVDB ID: 18473: Business Objects Enterprise/Crystal Reports Crafted Request crystalras.exe DoS
- SA16282: Business Objects Enterprise / Crystal Reports Denial of Service
- SECTRACK ID: 1014604: Crystal Reports Server Unspecified Flaw in Web Interface Lets Remote Users Deny Service
- SECTRACK ID: 1014605: BusinessObjects Enterprise Unspecified Flaw in Web Interface Lets Remote Users Deny Service
Reported:
Aug 01, 2005
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net