Crystal Reports .RPT process buffer overflow
| crystalreports-rpt-bo (30532) |  High Risk |
Description:
Crystal Reports is vulnerable to a stack-based buffer overflow, caused by improper bounds checking by the RPT process. By sending a malicious .RPT file, a remote attacker could overflow a buffer and execute arbitrary code on the system when the file is viewed.
Note: This vulnerability also affects Crystal Reports for Microsoft Visual Studio.
*CVSS:
| Base Score: | 8 |
| Access Vector: | Remote |
| Access Complexity: | High |
| Authentication: | Not Required |
| Confidentiality Impact: | Complete |
| Integrity Impact: | Complete |
| Availability Impact: | Complete |
| Temporal Score: | 5.9 |
| Exploitability: | Unproven |
| Remediation Level: | Official-Fix |
| Report Confidence: | Confirmed |
Consequences:
Gain Access
Remedy:
For BusinessObjects Enterprise XI, Crystal Enterprise 10, Crystal Reports XI, Crystal Reports 10, Crystal Reports Server XI, and Crystal Reports .NET:
Refer to BusinessObjects KBase Article ID: 1410607 for patch, upgrade, or suggested workaround information. See References.
For Microsoft Visual Studio:
Apply the appropriate patch for your system, as listed in Microsoft Security Bulletin MS07-052. See References.
For Hewlett-Packard:
Refer to HPSBST02260 SSRT071471 for patch, upgrade, or suggested workaround information. See References.
For other distributions:
Contact your vendor for upgrade or patch information.
References:
- BugTraq Mailing List, Thu Nov 23 2006 - 11:27:46 CST : LS-20061102 - Business Objects Crystal Reports Stack Overflow Vulnerability.
- BusinessObjects KBase Article ID: 1410607: KBase Article ID:1410607.
- HPSBST02260 SSRT071471 : Storage Management Appliance (SMA), Microsoft Patch Applicability MS07-051 to MS07-054.
- LS-20061102: Business Objects Crystal Reports XI Professional Stack Overflow Vulnerability.
- Microsoft Security Bulletin MS07-052: Vulnerability in Crystal Reports for Visual Studio Could Allow Remote Code Execution (941522).
- ASA-2007-377: MS07-052 Vulnerability in Crystal Reports for Visual Studio Could Allow Remote Code Execution (941522)
- BID-21261: Business Objects Crystal Reports XI Professional File Handling Buffer Overflow Vulnerability
- CVE-2006-6133: Stack-based buffer overflow in Visual Studio Crystal Reports for Microsoft Visual Studio .NET 2002 and 2002 SP1, .NET 2003 and 2003 SP1, and 2005 and 2005 SP1 (formerly Business Objects Crystal Reports XI Professional) allows user-assisted remote attackers to execute arbitrary code via a crafted RPT file.
- SA23091: Crystal Reports RPT Processing Buffer Overflow Vulnerability
- SA26754: Visual Studio Crystal Reports RPT Processing Buffer Overflow
- SECTRACK ID: 1017279: Crystal Reports Report File Stack Overflow Lets Remote Users Execute Arbitrary Code
- VUPEN/ADV-2006-4691: Business Objects Products RPT File Processing Client-Side Buffer Overflow Vulnerability
- VUPEN/ADV-2007-3114: Microsoft Visual Studio Crystal Reports Code Execution Vulnerability (MS07-052)
Platforms Affected:
- BusinessObjects Crystal Reports XI Professional
- HP Storage Management Appliance 2.1
- Microsoft Visual Studio 2002 SP1
- Microsoft Visual Studio 2003
- Microsoft Visual Studio 2003 SP1
- Microsoft Visual Studio 2005 SP1
- Microsoft Visual Studio 2005
- Microsoft Windows Vista
Reported:
Nov 23, 2006
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net
* According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an "industry open standard designed to convey vulnerability severity and help to determine urgency and priority of response." IBM PROVIDES THE CVSS SCORES "AS IS" WITHOUT WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall IBM be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.