Alert: Microsoft Security Bulletin MS04-017 - Vulnerability in Crystal Reports Web Viewer Could Allow Information Disclosure and Denial of Service (842689)

From: Russ Cooper (Russ.Cooper_at_TRUSECURE.CA)
Date: 06/15/04

  • Next message: http-equiv_at_excite.com: "MAGIC XSS INTO THE DNS: coelacanth" 
    Date:         Tue, 15 Jun 2004 17:36:17 -0400
To: NTBUGTRAQ@LISTSERV.NTBUGTRAQ.COM

    Microsoft Security Bulletin MS04-017:
    Vulnerability in Crystal Reports Web Viewer Could Allow Information
    Disclosure and Denial of Service (842689)

    Bulletin URL:
    <http://www.microsoft.com/technet/security/bulletin/MS04-017.mspx>

    Version Number: 1.0
    Issued Date: Tuesday, June 08, 2004
    Impact of Vulnerability: Information Disclosure and Denial of Service
    Maximum Severity Rating: Moderate
    Patch(es) Replaced: None
    Caveats: Customers who use both Visual Studio .NET 2003 and Outlook 2003
    with Business Contact Manager, and who have Internet Information
    Services installed should install the update for both products. The
    update for the component in Microsoft Business Solutions CRM 1.2 is
    available on the Business Objects Web site.

    Executive Summary:
    ------------------
    This update resolves a newly-discovered vulnerability in Crystal Reports
    and Crystal Enterprise from Business Objects. Microsoft Visual Studio
    .NET 2003 (all versions) and Outlook 2003 with Business Contact Manager
    redistribute Crystal Reports and are therefore affected by the
    vulnerability. Microsoft Business Solutions CRM 1.2 redistributes
    Crystal Enterprise, which is affected in the same way. The vulnerability
    is documented in the Vulnerability Details section of this bulletin.

    An attacker who successfully exploited the vulnerability could retrieve
    and delete files through the Crystal Reports and Crystal Enterprise Web
    viewers on an affected system. The number of files of files that are
    impacted by this vulnerability would depend on the security context of
    the affected component that is used by the Crystal Web viewer.

    Note Systems can only be vulnerable if they have Internet Information
    Services (IIS) installed.

    Tested Software:
    Affected Software:
    ------------------
    * Visual Studio .NET 2003
    <http://tinyurl.com/2s823>
    * Outlook 2003 with Business Contact Manager
    <http://tinyurl.com/3h3hj>
    * Microsoft Business Solutions CRM 1.2
    <http://tinyurl.com/2m9qx>

    Technical Description:
    ----------------------
    * Directory Traversal Vulnerability - CAN-2004-0204: A directory
    traversal vulnerability exists in Crystal Reports and Crystal Enterprise
    from Business Objects that could allow Information Disclosure and Denial
    of Service attacks on an affected system. An attacker who successfully
    exploited the vulnerability could retrieve and delete files through the
    Crystal Reports and Crystal Enterprise Web interface on an affected
    system.

    This email is sent to NTBugtraq automagically as a service to my
    subscribers. (v4.01.1625.28734)

    Cheers,
    Russ - Senior Scientist - TruSecure Corporation/NTBugtraq Editor

    -----
    NTBugtraq Editor's Note:

    Want to reply to the person who sent this message? This list is configured such that just hitting reply is going to result in the message coming to the list, not to the individual who sent the message. This was done to help reduce the number of Out of Office messages posters received. So if you want to send a reply just to the poster, you''ll have to copy their email address out of the message and place it in your TO: field.
    -----

  • Next message: http-equiv_at_excite.com: "MAGIC XSS INTO THE DNS: coelacanth"

    Relevant Pages