(Microsoft Issues Fix for Visual Studio .NET) Crystal Reports Input Validation Flaws Let Remote Users View and Delete Files and Deny Service
|
|
SecurityTracker Alert ID: 1010426
|
|
SecurityTracker URL: http://securitytracker.com/id?1010426
|
|
CVE Reference: CAN-2004-0204
(Links to External Site)
|
Date: Jun 8 2004
|
Impact: Denial of service via network, Disclosure of system information, Disclosure of user information, Modification of system information, Modification of user information
|
Fix Available: Yes
Vendor Confirmed: Yes
|
Version(s): 2003
|
Description: Several vunerabilities were reported in Crystal Reports. A remote user can view and delete arbitrary files on the target system.
Microsoft Visual Studio .NET 2003 (all versions) includes Crystal Reports and, therefore, is affected by this vulnerability.
Ofer Maor from Imperva reported these vulnerabilities.
The vendor has reportedly been notified without response.
No further details were provided.
|
Impact: A remote user can view and delete arbitrary files on the target system.
A remote user can cause denial of service conditions on the target system.
|
Solution: Microsoft has issued the following fix for Visual Studio .NET 2003 (which includes the affected Crystal Reports product):
http://www.microsoft.com/downloads/details.asp
x?FamilyId=659CA40E-808D-431D-A7D3-33BC3ACE922D&displaylang=en
The Microsoft Security Bulletin MS04-017 is available at:
http://www.microsoft.com/technet/security/b
ulletin/ms04-017.mspx
|
Vendor URL: www.microsoft.com/technet/security/bulletin/ms04-017.mspx (Links to External Site)
|
Cause: Input validation error
|
Underlying OS: Windows (2000), Windows (2003), Windows (XP)
|
|
Message History:
This archive entry is a follow-up to the message listed below.
|
Source Message Contents
|
Date: Tue, 08 Jun 2004 14:15:10 -0400
Subject: MS04-017
|
http://www.microsoft.com/technet/security/bulletin/ms04-017.mspx
Microsoft Security Bulletin MS04-017
Vulnerability in Crystal Reports Web Viewer Could Allow Information Disclosure and Denial
of Service (842689)
CVE: CAN-2004-0204:
Impact of Vulnerability: Information Disclosure and Denial of Service
Maximum Severity Rating: Moderate
Affected Software:
Visual Studio .NET 2003
Outlook 2003 with Business Contact Manager
Microsoft Business Solutions CRM 1.2
Microsoft reported that there is a directory traversal vulnerability in Crystal Reports
and Crystal Enterprise from Business Objects. A remote user can retrieve and delete files
via the Crystal Reports and Crystal Enterprise Web interface.
Microsoft has issued the following fixes:
Visual Studio .NET 2003:
http://www.microsoft.com/downloads/details.aspx?FamilyId=659CA40E-808D-431D-A7D3-33BC3ACE922D&dis
playlang=en
Outlook 2003 with Business Contact Manager:
http://www.microsoft.com/downloads/details.aspx?FamilyId=9016B9F3-BA86-4A95-9D89-E120EF2E85E3&dis
playlang=en
Microsoft Business Solutions CRM 1.2:
http://support.businessobjects.com/fix/hot/critical/ms_critical_updates.asp
|
|
