Description
Heap-based buffer overflow in the CrystalReports12.CrystalPrintControl.1 ActiveX control in PrintControl.dll 12.3.2.753 in SAP Crystal Reports 2008 SP3 Fix Pack 3.2 allows remote attackers to execute arbitrary code via a long ServerResourceVersion property value.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Metasploit 1 module
-
Crystal Reports CrystalPrintControl ActiveX ServerResourceVersion Property Overflow
exploit/windows/browser/crystal_reports_printcontrol
Exploit-DB 2
- Crystal Reports CrystalPrintControl - ActiveX ServerResourceVersion Property Overflow (Metasploit) EDB-23472 · remote · Dec 18, 2012 · verified
- Crystal Reports Viewer 12.0.0.549 - 'PrintControl.dll' ActiveX EDB-15733 · remote · Dec 14, 2010 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- https://service.sap.com/sap/support/notes/1539269
- 15733 exploit
- 45387 vdb-entry
- 20101220 Secunia Research: SAP Crystal Reports Print ActiveX Control Buffer Overflow mailing-list
- http://pocoftheday.blogspot.com/2010/12/crystal-reports-viewer-1200549-activex.html
- http://secunia.com/secunia_research/2010-135/
- 42305 third-party-advisory
- 69917 vdb-entry
- 1024915 vdb-entry