SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (E-mail Client)  >   Microsoft Outlook Vendors:   Microsoft
(Microsoft Issues Fix for Outlook 2003) Crystal Reports Input Validation Flaws Let Remote Users View and Delete Files and Deny Service
SecurityTracker Alert ID:  1010428
SecurityTracker URL:  http://securitytracker.com/id/1010428
CVE Reference:   CVE-2004-0204   (Links to External Site)
Date:  Jun 8 2004
Impact:   Denial of service via network, Disclosure of system information, Disclosure of user information, Modification of system information, Modification of user information
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): Outlook 2003 with Business Contact Manager
Description:   Several vunerabilities were reported in Crystal Reports and Crystal Enterprise. A remote user can view and delete arbitrary files on the target system. A remote user can also consume disk space on the target system. Microsoft Outlook 2003 with Business Contact Manager is affected.

Ofer Maor from Imperva reported that the crystalimagehandler.aspx, crystalimagehandler.asp, and crystalimagehandler.jsp scripts do not properly validate user-supplied image names in the 'dynamicimage' parameter. As a result, a remote user can supply a specially crafted parameter to view files on the target system.

Some demonstration exploit URLs are provided:

http://[target]/crystalreportviewers/crystalimagehandler.aspx?dynamicimage=..\win.ini

http://[target]/crystalreportviewers/crystalimagehandler.aspx?dynamicimage=..\..\boot.ini

After the file is delivered, the file is deleted.

It is also reported that a remote user can repeatedly invoke the report generation modules without retrieving the related images to cause the report engine to consume excessive disk space in the image file folder. A remote user can consume all available disk space, the report said.

A demonstration exploit URL is provided:

http://[target]/crystalreportviewers/crystalimagehandler.aspx?dynamicimage=..\..\..\..\..\mydocuments\private\passwords.txt

The vendor was reportedly notified on April 26, 2004.

Impact:   A remote user can view and delete arbitrary files on the target system.

A remote user can consume disk space on the target system.

Solution:   Microsoft indicates that Microsoft Outlooke 2003 Business Contact Manager includes Crystal Reports and, therefore, is affected by this vulnerability.

Microsoft has issued a fix for Outlook 2003 with Business Contact Manager, available at:

http://www.microsoft.com/downloads/details.aspx?FamilyId=9016B9F3-BA86-4A95-9D89-E120EF2E85E3&displaylang=en

Vendor URL:  www.microsoft.com/technet/security/bulletin/ms04-017.mspx (Links to External Site)
Cause:   Input validation error, Resource error
Underlying OS:  Windows (Any)

Message History:   This archive entry is a follow-up to the message listed below.
May 3 2004 Crystal Reports Input Validation Flaws Let Remote Users View and Delete Files and Deny Service



 Source Message Contents

Subject:  MS04-017


http://www.microsoft.com/technet/security/bulletin/ms04-017.mspx

Microsoft Security Bulletin MS04-017
Vulnerability in Crystal Reports Web Viewer Could Allow Information Disclosure and Denial 
of Service (842689)

CVE:  CAN-2004-0204:

Impact of Vulnerability:  Information Disclosure and Denial of Service

Maximum Severity Rating: Moderate

Affected Software:

Visual Studio .NET 2003

Outlook 2003 with Business Contact Manager

Microsoft Business Solutions CRM 1.2


Microsoft reported that there is a directory traversal vulnerability in Crystal Reports 
and Crystal Enterprise from Business Objects.  A remote user can retrieve and delete files 
via the Crystal Reports and Crystal Enterprise Web interface.

Microsoft has issued the following fixes:

Visual Studio .NET 2003:

http://www.microsoft.com/downloads/details.aspx?FamilyId=659CA40E-808D-431D-A7D3-33BC3ACE922D&displaylang=en

Outlook 2003 with Business Contact Manager:

http://www.microsoft.com/downloads/details.aspx?FamilyId=9016B9F3-BA86-4A95-9D89-E120EF2E85E3&displaylang=en

Microsoft Business Solutions CRM 1.2:

http://support.businessobjects.com/fix/hot/critical/ms_critical_updates.asp




 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2021, SecurityGlobal.net LLC