(Microsoft Issues Fix for Outlook 2003) Crystal Reports Input Validation Flaws Let Remote Users View and Delete Files and Deny Service
|
|
SecurityTracker Alert ID: 1010428 |
|
SecurityTracker URL: http://securitytracker.com/id/1010428
|
|
CVE Reference:
CVE-2004-0204
(Links to External Site)
|
Date: Jun 8 2004
|
Impact:
Denial of service via network, Disclosure of system information, Disclosure of user information, Modification of system information, Modification of user information
|
Fix Available: Yes Vendor Confirmed: Yes
|
Version(s): Outlook 2003 with Business Contact Manager
|
Description:
Several vunerabilities were reported in Crystal Reports and Crystal Enterprise. A remote user can view and delete arbitrary files on the target system. A remote user can also consume disk space on the target system. Microsoft Outlook 2003 with Business Contact Manager is affected.
Ofer Maor from Imperva reported that the crystalimagehandler.aspx, crystalimagehandler.asp, and crystalimagehandler.jsp scripts do not properly validate user-supplied image names in the 'dynamicimage' parameter. As a result, a remote user can supply a specially crafted parameter to view files on the target system.
Some demonstration exploit URLs are provided:
http://[target]/crystalreportviewers/crystalimagehandler.aspx?dynamicimage=..\win.ini
http://[target]/crystalreportviewers/crystalimagehandler.aspx?dynamicimage=..\..\boot.ini
After the file is delivered, the file is deleted.
It is also reported that a remote user can repeatedly invoke the report generation modules without retrieving the related images to cause the report engine to consume excessive disk space in the image file folder. A remote user can consume all available disk space, the report said.
A demonstration exploit URL is provided:
http://[target]/crystalreportviewers/crystalimagehandler.aspx?dynamicimage=..\..\..\..\..\mydocuments\private\passwords.txt
The vendor was reportedly notified on April 26, 2004.
|
Impact:
A remote user can view and delete arbitrary files on the target system.
A remote user can consume disk space on the target system.
|
Solution:
Microsoft indicates that Microsoft Outlooke 2003 Business Contact Manager includes Crystal Reports and, therefore, is affected by this vulnerability.
Microsoft has issued a fix for Outlook 2003 with Business Contact Manager, available at:
http://www.microsoft.com/downloads/details.aspx?FamilyId=9016B9F3-BA86-4A95-9D89-E120EF2E85E3&displaylang=en
|
Vendor URL: www.microsoft.com/technet/security/bulletin/ms04-017.mspx (Links to External Site)
|
Cause:
Input validation error, Resource error
|
Underlying OS: Windows (Any)
|
|
Message History:
This archive entry is a follow-up to the message listed below.
|
Source Message Contents
|
Subject: MS04-017
|
http://www.microsoft.com/technet/security/bulletin/ms04-017.mspx
Microsoft Security Bulletin MS04-017
Vulnerability in Crystal Reports Web Viewer Could Allow Information Disclosure and Denial
of Service (842689)
CVE: CAN-2004-0204:
Impact of Vulnerability: Information Disclosure and Denial of Service
Maximum Severity Rating: Moderate
Affected Software:
Visual Studio .NET 2003
Outlook 2003 with Business Contact Manager
Microsoft Business Solutions CRM 1.2
Microsoft reported that there is a directory traversal vulnerability in Crystal Reports
and Crystal Enterprise from Business Objects. A remote user can retrieve and delete files
via the Crystal Reports and Crystal Enterprise Web interface.
Microsoft has issued the following fixes:
Visual Studio .NET 2003:
http://www.microsoft.com/downloads/details.aspx?FamilyId=659CA40E-808D-431D-A7D3-33BC3ACE922D&displaylang=en
Outlook 2003 with Business Contact Manager:
http://www.microsoft.com/downloads/details.aspx?FamilyId=9016B9F3-BA86-4A95-9D89-E120EF2E85E3&displaylang=en
Microsoft Business Solutions CRM 1.2:
http://support.businessobjects.com/fix/hot/critical/ms_critical_updates.asp
|
|
