Business Objects Crystal Reports Web Form Viewer Directory Traversal Vulnerability

Bugtraq ID:	10260
Class:	Input Validation Error
CVE:	CVE-2004-0204
Remote:	Yes
Local:	No
Published:	May 03 2004 12:00AM
Updated:	Jul 12 2009 04:07AM
Credit:	Discovery is credited to Imperva Application Defense Center <[email protected]>.
Vulnerable:	Microsoft Visual Studio .NET 2003 + Microsoft Visual Basic .NET Standard 2003 + Microsoft Visual C# .NET Standard 2003 + Microsoft Visual C++ .NET Standard 2003 + Microsoft Visual J# .NET Standard 2003 Microsoft Outlook 2003 with Business Contact Manager Microsoft Business Solutions CRM 1.2 Business Objects Crystal Reports 10.0 Business Objects Crystal Reports 9.0 Business Objects Crystal Enterprise RAS for UNIX 8.5 Business Objects Crystal Enterprise Java SDK 8.5 Business Objects Crystal Enterprise 10.0 Business Objects Crystal Enterprise 9.0 Borland J Builder BEA Systems WebLogic Server for Win32 8.1 SP 2 BEA Systems WebLogic Server for Win32 8.1 SP 1 BEA Systems WebLogic Server for Win32 8.1 BEA Systems WebLogic Server for Win32 7.0 SP 5 BEA Systems WebLogic Server for Win32 7.0 SP 4 BEA Systems WebLogic Server for Win32 7.0 SP 3 BEA Systems WebLogic Server for Win32 7.0 SP 2 BEA Systems WebLogic Server for Win32 7.0 SP 1 BEA Systems WebLogic Server for Win32 7.0 - Microsoft Windows 2000 Advanced Server SP2 - Microsoft Windows 2000 Advanced Server SP1 - Microsoft Windows 2000 Advanced Server - Microsoft Windows 2000 Datacenter Server SP2 - Microsoft Windows 2000 Datacenter Server SP1 - Microsoft Windows 2000 Datacenter Server - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 2000 Server SP2 - Microsoft Windows 2000 Server SP1 - Microsoft Windows 2000 Server - Microsoft Windows 2000 Terminal Services SP2 - Microsoft Windows 2000 Terminal Services SP1 - Microsoft Windows 2000 Terminal Services - Microsoft Windows NT Enterprise Server 4.0 SP6a - Microsoft Windows NT Enterprise Server 4.0 SP6 - Microsoft Windows NT Enterprise Server 4.0 SP5 - Microsoft Windows NT Enterprise Server 4.0 SP4 - Microsoft Windows NT Enterprise Server 4.0 SP3 - Microsoft Windows NT Enterprise Server 4.0 SP2 - Microsoft Windows NT Enterprise Server 4.0 SP1 - Microsoft Windows NT Enterprise Server 4.0 - Microsoft Windows NT Server 4.0 SP6a - Microsoft Windows NT Server 4.0 SP6 - Microsoft Windows NT Server 4.0 SP5 - Microsoft Windows NT Server 4.0 SP4 - Microsoft Windows NT Server 4.0 SP3 - Microsoft Windows NT Server 4.0 SP2 - Microsoft Windows NT Server 4.0 SP1 - Microsoft Windows NT Server 4.0 - Microsoft Windows NT Terminal Server 4.0 SP6 - Microsoft Windows NT Terminal Server 4.0 SP5 - Microsoft Windows NT Terminal Server 4.0 SP4 - Microsoft Windows NT Terminal Server 4.0 SP3 - Microsoft Windows NT Terminal Server 4.0 SP2 - Microsoft Windows NT Terminal Server 4.0 SP1 - Microsoft Windows NT Terminal Server 4.0 - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 BEA Systems Weblogic Server 8.1 SP 2 BEA Systems Weblogic Server 8.1 SP 1 BEA Systems Weblogic Server 8.1 BEA Systems Weblogic Server 7.0 SP 5 BEA Systems Weblogic Server 7.0 SP 4 BEA Systems Weblogic Server 7.0 SP 3 BEA Systems Weblogic Server 7.0 SP 2 BEA Systems Weblogic Server 7.0 SP 1 BEA Systems Weblogic Server 7.0 - HP HP-UX 11.0 - HP HP-UX 11i v1 - IBM AIX 4.3.3 - Microsoft Windows 2000 Advanced Server SP2 - Microsoft Windows 2000 Advanced Server SP1 - Microsoft Windows 2000 Advanced Server - Microsoft Windows 2000 Datacenter Server SP2 - Microsoft Windows 2000 Datacenter Server SP1 - Microsoft Windows 2000 Datacenter Server - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 2000 Server SP2 - Microsoft Windows 2000 Server SP1 - Microsoft Windows 2000 Server - Microsoft Windows NT Enterprise Server 4.0 SP6a - Microsoft Windows NT Enterprise Server 4.0 SP6 - Microsoft Windows NT Enterprise Server 4.0 SP5 - Microsoft Windows NT Enterprise Server 4.0 SP4 - Microsoft Windows NT Server 4.0 SP6a - Microsoft Windows NT Server 4.0 SP6 - Microsoft Windows NT Server 4.0 SP5 - Microsoft Windows NT Server 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Redhat Linux 7.1 i386 - Redhat Linux 6.2 i386 - Sun Solaris 8_sparc - Sun Solaris 2.7_sparc - Sun Solaris 2.6_sparc BEA Systems WebLogic Express for Win32 8.1 SP 2 BEA Systems WebLogic Express for Win32 8.1 SP 1 BEA Systems WebLogic Express for Win32 8.1 BEA Systems WebLogic Express for Win32 7.0 SP 5 BEA Systems WebLogic Express for Win32 7.0 SP 4 BEA Systems WebLogic Express for Win32 7.0 SP 3 BEA Systems WebLogic Express for Win32 7.0 SP 2 BEA Systems WebLogic Express for Win32 7.0 SP 1 BEA Systems WebLogic Express for Win32 7.0 - Microsoft Windows 2000 Advanced Server SP2 - Microsoft Windows 2000 Advanced Server SP1 - Microsoft Windows 2000 Advanced Server - Microsoft Windows 2000 Datacenter Server SP2 - Microsoft Windows 2000 Datacenter Server SP1 - Microsoft Windows 2000 Datacenter Server - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 2000 Server SP2 - Microsoft Windows 2000 Server SP1 - Microsoft Windows 2000 Server - Microsoft Windows 2000 Terminal Services SP2 - Microsoft Windows 2000 Terminal Services SP1 - Microsoft Windows 2000 Terminal Services - Microsoft Windows NT Enterprise Server 4.0 SP6a - Microsoft Windows NT Enterprise Server 4.0 SP6 - Microsoft Windows NT Enterprise Server 4.0 SP5 - Microsoft Windows NT Enterprise Server 4.0 SP4 - Microsoft Windows NT Enterprise Server 4.0 SP3 - Microsoft Windows NT Enterprise Server 4.0 SP2 - Microsoft Windows NT Enterprise Server 4.0 SP1 - Microsoft Windows NT Enterprise Server 4.0 - Microsoft Windows NT Server 4.0 SP6a - Microsoft Windows NT Server 4.0 SP6 - Microsoft Windows NT Server 4.0 SP5 - Microsoft Windows NT Server 4.0 SP4 - Microsoft Windows NT Server 4.0 SP3 - Microsoft Windows NT Server 4.0 SP2 - Microsoft Windows NT Server 4.0 SP1 - Microsoft Windows NT Server 4.0 - Microsoft Windows NT Terminal Server 4.0 SP6 - Microsoft Windows NT Terminal Server 4.0 SP5 - Microsoft Windows NT Terminal Server 4.0 SP4 - Microsoft Windows NT Terminal Server 4.0 SP3 - Microsoft Windows NT Terminal Server 4.0 SP2 - Microsoft Windows NT Terminal Server 4.0 SP1 - Microsoft Windows NT Terminal Server 4.0 - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 BEA Systems WebLogic Express 8.1 SP 2 BEA Systems WebLogic Express 8.1 SP 1 BEA Systems WebLogic Express 8.1 BEA Systems WebLogic Express 7.0 SP 5 BEA Systems WebLogic Express 7.0 SP 4 BEA Systems WebLogic Express 7.0 SP 3 BEA Systems WebLogic Express 7.0 SP 2 BEA Systems WebLogic Express 7.0 SP 1 BEA Systems WebLogic Express 7.0 - HP HP-UX 11.0 - HP HP-UX 11i v1 - IBM AIX 4.3.3 - Microsoft Windows 2000 Advanced Server SP2 - Microsoft Windows 2000 Advanced Server SP1 - Microsoft Windows 2000 Advanced Server - Microsoft Windows 2000 Datacenter Server SP2 - Microsoft Windows 2000 Datacenter Server SP1 - Microsoft Windows 2000 Datacenter Server - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 2000 Server SP2 - Microsoft Windows 2000 Server SP1 - Microsoft Windows 2000 Server - Microsoft Windows NT Enterprise Server 4.0 SP6a - Microsoft Windows NT Enterprise Server 4.0 SP6 - Microsoft Windows NT Enterprise Server 4.0 SP5 - Microsoft Windows NT Enterprise Server 4.0 SP4 - Microsoft Windows NT Server 4.0 SP6a - Microsoft Windows NT Server 4.0 SP6 - Microsoft Windows NT Server 4.0 SP5 - Microsoft Windows NT Server 4.0 SP4 - Redhat Linux 7.1 i386 - Redhat Linux 6.2 i386 - Sun Solaris 8_sparc - Sun Solaris 2.7_sparc - Sun Solaris 2.6_sparc
Not Vulnerable:	BEA Systems WebLogic Server for Win32 8.1 SP 3 BEA Systems Weblogic Server 8.1 SP 3 BEA Systems WebLogic Express for Win32 8.1 SP 3 BEA Systems WebLogic Express 8.1 SP 3

Business Objects Crystal Reports Web Form Viewer Directory Traversal Vulnerability

Crystal Reports and Crystal Enterprise Web Form Viewer is prone to a directory traversal vulnerability. This issue can allow an attacker to retrieve and delete files, allowing for information disclosure and denial of service attacks.

An attacker can exploit this issue by sending directory traversal sequences and requesting a file through a vulnerable parameter of one of the affected modules.

Microsoft Visual Studio .NET 2003, Outlook 2003 with Business Contact Manager, and Business Solutions CRM 1.2 are also vulnerable to this issue as Microsoft re-distributes Crystal Reports.

Business Objects Crystal Reports Web Form Viewer Directory Traversal Vulnerability

No exploit is required.

The following proof of concept is available:
http://www.example.com/crystalreportviewers/crystalimagehandler.aspx?dynamicimage=..\..\..\..\..\mydocuments\private\passwords.txt

Business Objects Crystal Reports Web Form Viewer Directory Traversal Vulnerability

Solution:
BEA Systems has released advisory BEA04-63.00 to address this issue. Users of the WebLogic platform are advised to apply the appropriate Business Objects updates for this vulnerability. Fixes have also been included in WebLogic 8.1 SP 3.

Business Objects has released a security bulletin to address this issue.

Microsoft Security Bulletin MS04-017 is available to address this issue.


Microsoft Visual Studio .NET 2003

• Microsoft Visual Studio .NET 2003 Crystal Reports Security Update
  http://www.microsoft.com/downloads/details.aspx?FamilyId=659CA40E-808D -431D-A7D3-33BC3ACE922D&displaylang=en

Borland J Builder

• Business Objects cr10jbuilder_critical_update_win.zip
  For Windows.
  ftp://ftp1.businessobjects.com/outgoing/ehf/CriticalUpdate/cr10jbuilde r_critical_update_win.zip


• Business Objects crjbuilder10critical_update_lnx.tar.gz
  For Linux.
  ftp://ftp1.businessobjects.com/outgoing/ehf/CriticalUpdate/crjbuilder1 0critical_update_lnx.tar.gz


• Business Objects crjbuilder10critical_update_sol.tar.gz
  For Solaris.
  ftp://ftp1.businessobjects.com/outgoing/ehf/CriticalUpdate/crjbuilder1 0critical_update_sol.tar.gz

Microsoft Outlook 2003 with Business Contact Manager

• Microsoft Business Contact Manager for Outlook 2003 Security Update: KB842496
  http://www.microsoft.com/downloads/details.aspx?FamilyId=9016B9F3-BA86 -4A95-9D89-E120EF2E85E3&displaylang=en

Business Objects Crystal Reports 10.0

• Business Objects v10_critical_update_win.zip
  For Windows.
  ftp://ftp1.businessobjects.com/outgoing/ehf/CriticalUpdate/v10_critica l_update_win.zip

Business Objects Crystal Enterprise 10.0

• Business Objects ce10critical_update_aix.tar.gz
  For AIX.
  ftp://ftp1.businessobjects.com/outgoing/ehf/CriticalUpdate/ce10critica l_update_aix.tar.gz


• Business Objects ce10critical_update_sol.tar.gz
  For Solaris.
  ftp://ftp1.businessobjects.com/outgoing/ehf/CriticalUpdate/ce10critica l_update_sol.tar.gz


• Business Objects v10_critical_update_win.zip
  For Windows.
  ftp://ftp1.businessobjects.com/outgoing/ehf/CriticalUpdate/v10_critica l_update_win.zip

BEA Systems Weblogic Server 8.1 SP 1

• Business Objects bea81_critical_update_unix.tar.gz
  For Linux.
  ftp://ftp1.businessobjects.com/outgoing/ehf/CriticalUpdate/bea81_criti cal_update_unix.tar.gz


• Business Objects bea81_critical_update_unix.tar.gz
  For Solaris.
  ftp://ftp1.businessobjects.com/outgoing/ehf/CriticalUpdate/bea81_criti cal_update_unix.tar.gz

BEA Systems Weblogic Server 8.1 SP 2

• Business Objects bea81_critical_update_unix.tar.gz
  For Linux.
  ftp://ftp1.businessobjects.com/outgoing/ehf/CriticalUpdate/bea81_criti cal_update_unix.tar.gz


• Business Objects bea81_critical_update_unix.tar.gz
  For Solaris.
  ftp://ftp1.businessobjects.com/outgoing/ehf/CriticalUpdate/bea81_criti cal_update_unix.tar.gz

BEA Systems WebLogic Server for Win32 8.1 SP 2

• Business Objects bea81_critical_update_win.zip
  For Windows.
  ftp://ftp1.businessobjects.com/outgoing/ehf/CriticalUpdate/bea81_criti cal_update_win.zip

BEA Systems WebLogic Server for Win32 8.1

• Business Objects bea81_critical_update_win.zip
  For Windows.
  ftp://ftp1.businessobjects.com/outgoing/ehf/CriticalUpdate/bea81_criti cal_update_win.zip

BEA Systems Weblogic Server 8.1

• Business Objects bea81_critical_update_unix.tar.gz
  For Linux.
  ftp://ftp1.businessobjects.com/outgoing/ehf/CriticalUpdate/bea81_criti cal_update_unix.tar.gz


• Business Objects bea81_critical_update_unix.tar.gz
  For Solaris.
  ftp://ftp1.businessobjects.com/outgoing/ehf/CriticalUpdate/bea81_criti cal_update_unix.tar.gz

BEA Systems WebLogic Server for Win32 8.1 SP 1

• Business Objects bea81_critical_update_win.zip
  For Windows.
  ftp://ftp1.businessobjects.com/outgoing/ehf/CriticalUpdate/bea81_criti cal_update_win.zip

Business Objects Crystal Enterprise Java SDK 8.5

• Business Objects ce85critical_update_jcesol.tar.gz
  For Solaris.
  ftp://ftp1.businessobjects.com/outgoing/ehf/CriticalUpdate/ce85critica l_update_jcesol.tar.gz


• Business Objects v85_critical_update_win.zip
  For Windows.
  ftp://ftp1.businessobjects.com/outgoing/ehf/CriticalUpdate/v85_critica l_update_win.zip

Business Objects Crystal Enterprise 9.0

• Business Objects v9_critical_update_win.zip
  For Windows.
  ftp://ftp1.businessobjects.com/outgoing/ehf/CriticalUpdate/v9_critical _update_win.zip

Business Objects Crystal Reports Web Form Viewer Directory Traversal Vulnerability

References:

• Crystal Reports Product Page (Business Objects)
  
• Microsoft Security Bulletin MS04-017 (Microsoft)
  
• SECURITY ADVISORY (BEA04-63.00) (BEA Systems)
  
• Vulnerability in Crystal Reports Web Viewer (Business Objects)
  
• Crystal Reports Vulnerabilities ("Imperva Application Defense Center" )
  
• Vulnerability: Arbitrary File Access & DoS in Crystal Reports ("Imperva Application Defense Center" )