You are here

T-542: SAP Crystal Reports Server Multiple Vulnerabilities

January 25, 2011 - 2:30pm

Addthis

PROBLEM:

SAP Crystal Reports Server Multiple Vulnerabilities.

 

PLATFORM:
 

Crystal Reports Server 2008

 

ABSTRACT:
 

Multiple vulnerabilities in SAP Crystal Reports Server 2008, which can be exploited by malicious users to disclose potentially sensitive information and by malicious people to conduct cross-site scripting attacks, manipulate certain data, and compromise a user's system.

 

 

 

reference LINKS:

 

Secunia Advisory SA43060
Vulnerability Report: Crystal Reports Server 2008

  
 

 IMPACT ASSESSMENT:

High
 

Discussion:

1) Input passed to the "actId" parameter in InfoViewApp/jsp/common/actionNav.jsp, "backUrl" parameter in InfoViewApp/jsp/common/error.jsp, and "logonAction" parameter in InfoViewApp/logon.jsp is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

2) An insecure "CreateTextFile()" method in an ActiveX control (scriptinghelpers.dll) can be exploited to overwrite existing files.

3) An insecure "LaunchProgram()" method in an ActiveX control (scriptinghelpers.dll) can be exploited to execute an arbitrary program.

4) An insecure "DeleteFile()" method in an ActiveX control (scriptinghelpers.dll) can be exploited to delete an arbitrary file.

5) An insecure "Kill()" method in an ActiveX control (scriptinghelpers.dll) can be exploited to terminate a running process.

Successful exploitation of this vulnerability requires knowing a valid process id.

6) Input passed to the "path" parameter in PerformanceManagement/jsp/qa.jsp (when "func" is set to "browse" and "root" is set to "wi") is not properly verified before being used to read files. This can be exploited to display arbitrary files from local resources via directory traversal attacks.

Successful exploitation of this vulnerability requires valid credentials.

SAP Client Support Advisory 1458310
SAP Client Support Advisory 1458309
SAP Client Support Advisory 1458930

 

 

Solution:

Vulnerability Report: Crystal Reports Server 2008
This vulnerability report for Crystal Reports Server 2008 contains a complete overview of all Secunia advisories affecting it. SAP client can use this vulnerability report to ensure that you are aware of all vulnerabilities, both patched and unpatched, affecting this product allowing you to take the necessary precautions.
SAP update
SAP Client Support

 

Addthis