Crystal Reports 'EnterpriseControls.dll' ActiveX Control Buffer Overflow Vulnerability

Bugtraq ID:	27333
Class:	Race Condition Error
CVE:	CVE-2008-0379
Remote:	Yes
Local:	No
Published:	Jan 17 2008 12:00AM
Updated:	May 07 2015 05:33PM
Credit:	shinnai is credited with the discovery of this vulnerability.
Vulnerable:	Business Objects Crystal Reports XI Release 2 0
Not Vulnerable:

Crystal Reports 'EnterpriseControls.dll' ActiveX Control Buffer Overflow Vulnerability

Crystal Reports 'EnterpriseControls.dll' ActiveX control is prone to a buffer-overflow vulnerability because the application fails to perform adequate boundary checks on user-supplied data.

A successful exploit will allow an attacker to crash applications using the affected ActiveX control (typically Internet Explorer).

This issue affects 'EnterpriseControls.dll' 11.5.0.313, which is contained in Crystal Reports XI Release 2; other versions may also be affected.

Crystal Reports 'EnterpriseControls.dll' ActiveX Control Buffer Overflow Vulnerability

To exploit this issue, attackers must entice an unsuspecting user to view a malicious web document.

Exploit code and further technical details are contained in the following file:

• /data/vulnerabilities/exploits/27333.txt

Crystal Reports 'EnterpriseControls.dll' ActiveX Control Buffer Overflow Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Crystal Reports 'EnterpriseControls.dll' ActiveX Control Buffer Overflow Vulnerability

References:

• Crystal Reports Product Page (Business Objects)
  
• Microsoft Knowledge Base Article 240797 (Microsoft)