SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Generic)  >   Microsoft Visual Studio Vendors:   Microsoft
(Microsoft Issues Fix for Visual Studio .NET) Crystal Reports Input Validation Flaws Let Remote Users View and Delete Files and Deny Service
SecurityTracker Alert ID:  1010426
SecurityTracker URL:  http://securitytracker.com/id/1010426
CVE Reference:   CVE-2004-0204   (Links to External Site)
Date:  Jun 8 2004
Impact:   Denial of service via network, Disclosure of system information, Disclosure of user information, Modification of system information, Modification of user information
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 2003
Description:   Several vunerabilities were reported in Crystal Reports. A remote user can view and delete arbitrary files on the target system. Microsoft Visual Studio .NET 2003 (all versions) includes Crystal Reports and, therefore, is affected by this vulnerability.

Ofer Maor from Imperva reported that the crystalimagehandler.aspx, crystalimagehandler.asp, and crystalimagehandler.jsp scripts do not properly validate user-supplied image names in the 'dynamicimage' parameter. As a result, a remote user can supply a specially crafted parameter to view files on the target system.

Some demonstration exploit URLs are provided:

http://[target]/crystalreportviewers/crystalimagehandler.aspx?dynamicimage=..\win.ini

http://[target]/crystalreportviewers/crystalimagehandler.aspx?dynamicimage=..\..\boot.ini

After the file is delivered, the file is deleted.

It is also reported that a remote user can repeatedly invoke the report generation modules without retrieving the related images to cause the report engine to consume excessive disk space in the image file folder. A remote user can consume all available disk space, the report said.

A demonstration exploit URL is provided:

http://[target]/crystalreportviewers/crystalimagehandler.aspx?dynamicimage=..\..\..\..\..\mydocuments\private\passwords.txt

The vendor was reportedly notified on April 26, 2004.

Impact:   A remote user can view and delete arbitrary files on the target system.

A remote user can consume disk space on the target system.

Solution:   Microsoft has issued the following fix for Visual Studio .NET 2003 (which includes the affected Crystal Reports product):

http://www.microsoft.com/downloads/details.aspx?FamilyId=659CA40E-808D-431D-A7D3-33BC3ACE922D&displaylang=en

The Microsoft Security Bulletin MS04-017 is available at:

http://www.microsoft.com/technet/security/bulletin/ms04-017.mspx

Vendor URL:  www.microsoft.com/technet/security/bulletin/ms04-017.mspx (Links to External Site)
Cause:   Input validation error, Resource error
Underlying OS:  Windows (2000), Windows (2003), Windows (XP)

Message History:   This archive entry is a follow-up to the message listed below.
May 3 2004 Crystal Reports Input Validation Flaws Let Remote Users View and Delete Files and Deny Service



 Source Message Contents

Subject:  MS04-017


http://www.microsoft.com/technet/security/bulletin/ms04-017.mspx

Microsoft Security Bulletin MS04-017
Vulnerability in Crystal Reports Web Viewer Could Allow Information Disclosure and Denial 
of Service (842689)

CVE:  CAN-2004-0204:

Impact of Vulnerability:  Information Disclosure and Denial of Service

Maximum Severity Rating: Moderate

Affected Software:

Visual Studio .NET 2003

Outlook 2003 with Business Contact Manager

Microsoft Business Solutions CRM 1.2


Microsoft reported that there is a directory traversal vulnerability in Crystal Reports 
and Crystal Enterprise from Business Objects.  A remote user can retrieve and delete files 
via the Crystal Reports and Crystal Enterprise Web interface.

Microsoft has issued the following fixes:

Visual Studio .NET 2003:

http://www.microsoft.com/downloads/details.aspx?FamilyId=659CA40E-808D-431D-A7D3-33BC3ACE922D&displaylang=en

Outlook 2003 with Business Contact Manager:

http://www.microsoft.com/downloads/details.aspx?FamilyId=9016B9F3-BA86-4A95-9D89-E120EF2E85E3&displaylang=en

Microsoft Business Solutions CRM 1.2:

http://support.businessobjects.com/fix/hot/critical/ms_critical_updates.asp




 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2020, SecurityGlobal.net LLC